CVE-2026-56864: Vulnerability in golang.org/x/mod/sumdb Allows Malicious Module Content Delivery
Summary
CVE-2026-56864: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb. Affects toolchain across 3 version ranges.
< 1.25.13
>= 1.26.0-0, < 1.26.6
>= 1.27.0-0, < 1.27.0-rc.3
Fixed in 1.25.13, 1.26.6 or 1.27.0-rc.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-56864 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'golang.org/x/mod' package is a part of the Go programming language ecosystem, providing tools for module management, including functionalities for handling module versions and dependencies. This package is crucial for developers who rely on Go modules for building and maintaining their applications. The vulnerability in question arises from the way the package interacts with GOSUMDB, potentially exposing users to malicious content.
Vulnerability Detail
A malicious GOSUMDB can serve arbitrary module content that is not verified against the transparency log. This vulnerability allows a coordinated GOPROXY and GOSUMDB to deliver harmful module content to clients without detection, posing significant security risks to applications relying on these modules. The issue stems from the failure to properly validate module content against the expected transparency log, which could lead to the execution of untrusted code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.25.131.25.13go get toolchain@v1.25.13 -
>= 1.26.0-0, < 1.26.61.26.6go get toolchain@v1.26.6 -
>= 1.27.0-0, < 1.27.0-rc.31.27.0-rc.3go get toolchain@v1.27.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you suspect that your application may be affected, you can remove the existing module files and tidy up your module dependencies by executing the following commands in your terminal:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Conclusion
CVE-2026-56864 represents a significant security vulnerability in the golang.org/x/mod/sumdb package, allowing malicious content delivery through compromised GOSUMDB services. It is crucial for developers to update their packages and follow best practices to secure their applications against such threats.
See every vulnerability recorded for toolchain →
FAQ
The main issue is that a malicious GOSUMDB can serve unverified module content, which could lead to the execution of harmful code in applications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the affected packages to their patched versions as specified in the 'how_to_fix' section to mitigate the vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
Failing to address this vulnerability could result in the execution of malicious code, leading to data breaches, unauthorized access, or other security incidents.
References
Related vulnerabilities
Recent vulnerabilities recorded for toolchain.
