Checksum Validation Flaw in Go Toolchain by Google

CVE-2026-42501

What is CVE-2026-42501?

A flaw in the Go toolchain's validation of module checksums can be exploited by untrusted module proxies, allowing them to bypass checksum database validation. This can lead to the execution of altered versions of the toolchain without proper validation. Despite the go command's effort to verify hashes against the checksum database, a malicious proxy may return an empty or unrelated checksum response, resulting in successful validation and potential execution of untrusted modules. Users are advised to validate their dependencies and update their Go toolchain to mitigate this risk.

References