CVE-2026-56865
published 2026-08-13CVE-2026-56865: A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist…
PriorityP343high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.11%
1.2th percentile
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| go_toolchain | cmd_go | < 1.25.13 | 1.25.13 |
| go_toolchain | cmd_go | >= 1.26.0-0 < 1.26.6 | 1.26.6 |
| go_toolchain | cmd_go | >= 1.27.0-0 < 1.27.0-rc.3 | 1.27.0-rc.3 |
| golang.org | x_mod_golang.org_x_mod_sumdb_tlog | < 0.40.0 | 0.40.0 |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Go x-mod-sumdb-tlog signature verification
vuldb·2026-08-14
CVE-2026-56865 [CRITICAL] Go x-mod-sumdb-tlog signature verification
A vulnerability described as critical has been identified in Go. This impacts an unknown function of the component x-mod-sumdb-tlog. Executing a manipulation can lead to improper verification of cryptographic signature.
This vulnerability is handled as CVE-2026-56865. The attack can be executed remotely. There is not any exploit available.
Red Hat
golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
vendor_redhat·2026-08-13·CVSS 8.4
CVE-2026-56865 [HIGH] CWE-347 golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy (GOPROXY) could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [fedora-all]
bugzilla·2026-08-24·CVSS 8.4
CVE-2026-56865 [HIGH] CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [fedora-all]
CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine i
Bugzilla
CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
bugzilla·2026-08-24·CVSS 8.4
CVE-2026-56865 [HIGH] CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
CVE-2026-56865 golang-x-mod: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if
Bugzilla
CVE-2026-56865 gcc-epel: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
bugzilla·2026-08-24·CVSS 8.4
CVE-2026-56865 [HIGH] CVE-2026-56865 gcc-epel: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
CVE-2026-56865 gcc-epel: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you
Bugzilla
CVE-2026-56865 golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
bugzilla·2026-08-13·CVSS 8.4
CVE-2026-56865 [HIGH] CVE-2026-56865 golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
CVE-2026-56865 golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
2026-08-13
Published