Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Go toolchain cmd/go 1.26.9, 1.27.2 Clear all filters
TI-2026-69835 CVE-2026-94447 · GHSA-cgx4-3g64-rvr7

Checksum verification bypass for golang.org/toolchain in Go cmd/go

Priority LOW 35

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00102 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-354
TI-2026-69834 CVE-2026-94444 · GHSA-2f4j-3hgj-v9j7

Checksum bypass in Go cmd/go lets attackers substitute a module

Priority LOW 35

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00097 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-354