high 7.5

CVE-2026-56864 json

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

published 2026-08-13 2 mo ago modified 2026-09-03 2 mo ago also BIT-golang-2026-56864 , EUVD-2026-58514 , GO-2026-6180

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Patch / fix

fixed in 5 distros 4 links 2

bitnami golang 1.25.13, 1.26.6, 1.27.0
go toolchain 1.25.13, 1.26.6, 1.27.0-rc.3
go golang.org/x/mod 0.40.0
Go toolchain cmd/go 1.25.13, 1.26.6, 1.27.0-rc.3
golang.org/x/mod golang.org/x/mod/sumdb 0.40.0

debian suse opensuse alpine

golang-1.26 Debian 14 1.26.6-1
golang-1.27 Debian 14 1.27~rc3-1

debian advisories DEBIAN-CVE-2026-56864

helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
cosign SLES for SAP applications 16.0, SLES 16.0 3.1.3-160000.1.1
helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.3.0-160000.1.1
cosign SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.3-150400.3.57.1
govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.7-160000.1.1
go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.14-160000.1.1
go1.27 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.27.0-150000.1.6.1

suse advisories SUSE-SU-2026:24282-1 SUSE-SU-2026:24213-1 SUSE-SU-2026:23973-1 SUSE-SU-2026:23984-1 SUSE-SU-2026:4392-1 SUSE-SU-2026:23625-1

cosign openSUSE Leap 16.0 3.1.3-160000.1.1
helm openSUSE Leap 16.0 4.3.0-160000.1.1
cosign openSUSE Tumbleweed 3.1.3-1.1
govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
go1.26-openssl openSUSE Leap 16.0 1.26.7-160000.1.1
go1.25-openssl openSUSE Leap 16.0 1.25.14-160000.1.1
helm openSUSE Tumbleweed 4.2.4-1.1
go1.26 openSUSE Leap 16.0 1.26.6-160000.1.1

opensuse advisories openSUSE-SU-2026:22064-1 openSUSE-SU-2026:21983-1 openSUSE-SU-2026:11871-1 openSUSE-SU-2026:21761-1 openSUSE-SU-2026:21705-1 openSUSE-SU-2026:21696-1

go Alpine 3.24 1.26.8-r0

alpine advisories ALPINE-CVE-2026-56864

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

go.dev/cl/815000 patch
go.dev/cl/815020 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56864 updated 2026-11-06 cvss 8.1

golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB

Red Hat OpenShift Pipelines openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-operator-proxy-rhel9, openshift-pipelines/pipelines-operator-webhook-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-model-registry-rhel9
affected: workaround, no fix available
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/alertmanager-rhel9 1790854499, cluster-observability-operator/cluster-observability-rhel9-operator 1790854599
fixed: vendor fix RHSA-2026:74609
Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320, advanced-cluster-security/rhacs-rhel9-operator 1789411320
fixed: vendor fix RHSA-2026:67714
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1790854501, cluster-observability-operator/thanos-rhel9 1790854526, cluster-observability-operator/korrel8r-rhel9 1790854490, cluster-observability-operator/prometheus-rhel9 1790857922, cluster-observability-operator/perses-rhel9-operator 1790854601, cluster-observability-operator/logging-console-plugin-rhel9 1790854474, +17 more Red Hat ExternalDNS Operator edo/external-dns-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hypershift-addon-rhel9-operator Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-fact-rhel9 1788922546, advanced-cluster-security/rhacs-roxctl-rhel9 1789411320, advanced-cluster-security/rhacs-scanner-rhel9 1789068649, advanced-cluster-security/rhacs-collector-rhel9 1788907500, advanced-cluster-security/rhacs-operator-bundle 1789411320, advanced-cluster-security/rhacs-central-db-rhel9 1789411320, +5 more Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-collector-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 mo ago (2026-08-14)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	<1.25.13 >=1.26.0-0, <1.26.6 >=1.27.0-0, <1.27.0	1.25.13 1.26.6 1.27.0
go	toolchain	<1.25.13 >=1.26.0-0, <1.26.6 >=1.27.0-0, <1.27.0-rc.3	1.25.13 1.26.6 1.27.0-rc.3
go	golang.org/x/mod	<0.40.0	0.40.0

Affected products

Go toolchain cmd/go
golang.org/x/mod golang.org/x/mod/sumdb

Classification

Weakness

CWE-347 Improper Verification of Cryptographic Signature

References

go.dev /cl/815000
web, patch
go.dev /cl/815020
web, patch
go.dev /issue/80745
web, report
groups.google.com /g/golang-announce/c/94pEornpRlI
web
pkg.go.dev /vuln/GO-2026-6180
web
nvd.nist.gov /vuln/detail/CVE-2026-56864
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary