TI-2026-41000 CVE-2026-56864
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Priority LOW 39
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.
Vulnerabilities
2 records
TI-2026-41001 CVE-2026-56865
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Priority LOW 37
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.