CVE-2026-94444

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-944458.8A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Dis CVE-2026-944477.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a maliciou CVE-2026-944486.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new e CVE-2026-944497.5A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers f CVE-2026-94456.3A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.p CVE-2026-944507.5Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause CVE-2026-944516.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoint CVE-2026-944537.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa CVE-2026-944557.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middle CVE-2026-944569.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used CVE-2026-944574.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94464.7A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the fil