CVE-2026-56864

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by evaluating the transparency log.

Recommendations To determine if the system has been affected, execute the following command: rm -r go.sum go.work.sum vendor/ && go mod tidy.