Module Bypass Vulnerability in Go Tools Affecting GOPROXY

CVE-2026-56865

What is CVE-2026-56865?

A vulnerability in GOPROXY allows malicious entities to forge sumdb tiles, enabling them to bypass GOSUMDB checks. This can lead to the installation of attacker-controlled module content within local Go module caches. Despite previous concerns, measures have been implemented to ensure all tiles are now verified against their parent tiles, preventing unauthorized modifications. To mitigate the risk, affected users should regenerate their module files by running 'rm -r go.sum go.work.sum vendor/ && go mod tidy'.

References