CVE-2026-56865

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description A malicious GOPROXY could forge up to two sumdb tiles, enabling a requested module to bypass the GOSUMDB check. This allows attacker-controlled module content to persist in a local Go module cache, which cannot be detected by evaluating the transparency log (a public, append-only record used to verify the integrity of modules).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Run the command rm -r go.sum go.work.sum vendor/ && go mod tidy to determine if the system has been affected.