CVE-2026-56864

HighCVSS 7.5/10Last modified Sep 3, 2026

Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-347

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3
golang.org/x/mod	golang.org/x/mod/sumdb	< 0.40.0

References

Timeline

Published: Aug 13, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-568658.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an CVE-2026-568667.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without fra CVE-2026-56878.8A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStati CVE-2026-568768.1extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a CVE-2026-568776.3The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter a CVE-2026-568796.7In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of p CVE-2026-56887.3A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bi CVE-2026-568818.4In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of CVE-2026-568828.8In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution wit CVE-2026-568886.2In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation CVE-2026-568896.7In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege wi CVE-2026-56897.3A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/c