TI-2026-41000 CVE-2026-56864
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Priority LOW 39
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.
golang.org/x/mod
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
golang.org/x/mod records in CISA KEVNo golang.org/x/mod vulnerabilities are listed in CISA KEV.
Records
2 records
TI-2026-41001 CVE-2026-56865
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Priority LOW 37
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.