high 8.4

CVE-2026-56865 json

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

published 2026-08-13 2 mo ago modified 2026-09-03 2 mo ago also BIT-golang-2026-56865 , EUVD-2026-58513 , GO-2026-6179

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Patch / fix

fixed in 5 distros 6 links 2

bitnami golang 1.25.13, 1.26.6, 1.27.0
go toolchain 1.25.13, 1.26.6, 1.27.0-rc.3
go golang.org/x/mod 0.40.0
Go toolchain cmd/go 1.25.13, 1.26.6, 1.27.0-rc.3
golang.org/x/mod golang.org/x/mod/sumdb/tlog 0.40.0

debian ubuntu suse opensuse alpine azure linux

golang-1.26 Debian 14 1.26.6-1
golang-1.27 Debian 14 1.27~rc3-1

debian advisories DEBIAN-CVE-2026-56865

golang-1.22 Ubuntu 22.04 LTS 1.22.2-2~22.04.4
golang-1.22 Ubuntu 24.04 LTS 1.22.2-2ubuntu0.5

ubuntu advisories UBUNTU-CVE-2026-56865

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.3.0-160000.1.1
govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.7-160000.1.1
go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.14-160000.1.1
go1.27 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.27.0-150000.1.6.1
go1.26-openssl SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 1.26.7-150600.13.15.1
go1.25-openssl SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 1.25.14-150600.13.27.1

suse advisories SUSE-SU-2026:24282-1 SUSE-SU-2026:23973-1 SUSE-SU-2026:23984-1 SUSE-SU-2026:23625-1 SUSE-SU-2026:23576-1 SUSE-SU-2026:23573-1

helm openSUSE Leap 16.0 4.3.0-160000.1.1
govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
go1.26-openssl openSUSE Leap 16.0 1.26.7-160000.1.1
go1.25-openssl openSUSE Leap 16.0 1.25.14-160000.1.1
helm openSUSE Tumbleweed 4.2.4-1.1
go1.26 openSUSE Leap 16.0 1.26.6-160000.1.1
go1.25 openSUSE Leap 16.0 1.25.13-160000.1.1
go1.27 openSUSE Tumbleweed 1.27rc3-1.1

opensuse advisories openSUSE-SU-2026:21983-1 openSUSE-SU-2026:21761-1 openSUSE-SU-2026:21705-1 openSUSE-SU-2026:21696-1 openSUSE-SU-2026:11575-1 openSUSE-SU-2026:21593-1

go Alpine 3.24 1.26.8-r0

alpine advisories ALPINE-CVE-2026-56865

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

golang Azure Linux 3.0 1.26.6-1

azure linux advisories AZL-96683

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.dev/cl/814960 patch
go.dev/cl/815020 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56865 updated 2026-11-06 cvss 8.8

golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass

Red Hat ExternalDNS Operator edo/external-dns-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hypershift-addon-rhel9-operator Red Hat OpenShift Pipelines openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-operator-proxy-rhel9, openshift-pipelines/pipelines-operator-webhook-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-collector-rhel9
affected: workaround, no fix available “No mitigation is available for this vulnerability. Update the affected packages to golang.org/x/mod version 0.40.0 or later, or Go toolchain version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later.”
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/alertmanager-rhel9 1790854499, cluster-observability-operator/cluster-observability-rhel9-operator 1790854599
fixed: vendor fix “No mitigation is available for this vulnerability. Update the affected packages to golang.org/x/mod version 0.40.0 or later, or Go toolchain version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later.” RHSA-2026:74609
Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320, advanced-cluster-security/rhacs-rhel9-operator 1789411320
fixed: vendor fix “No mitigation is available for this vulnerability. Update the affected packages to golang.org/x/mod version 0.40.0 or later, or Go toolchain version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later.” RHSA-2026:67714
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1790854501, cluster-observability-operator/thanos-rhel9 1790854526, cluster-observability-operator/korrel8r-rhel9 1790854490, cluster-observability-operator/prometheus-rhel9 1790857922, cluster-observability-operator/perses-rhel9-operator 1790854601, cluster-observability-operator/logging-console-plugin-rhel9 1790854474, +17 more Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-fact-rhel9 1788922546, advanced-cluster-security/rhacs-roxctl-rhel9 1789411320, advanced-cluster-security/rhacs-scanner-rhel9 1789068649, advanced-cluster-security/rhacs-collector-rhel9 1788907500, advanced-cluster-security/rhacs-operator-bundle 1789411320, advanced-cluster-security/rhacs-central-db-rhel9 1789411320, +5 more Red Hat Enterprise Linux 7 compat-sap-c++-11 11.1.1-6.el7_9 Red Hat Enterprise Linux 8 compat-sap-c++-11 11.1.1-6.el7_9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-08-14)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	<1.25.13 >=1.26.0-0, <1.26.6 >=1.27.0-0, <1.27.0	1.25.13 1.26.6 1.27.0
go	toolchain	<1.25.13 >=1.26.0-0, <1.26.6 >=1.27.0-0, <1.27.0-rc.3	1.25.13 1.26.6 1.27.0-rc.3
go	golang.org/x/mod	<0.40.0	0.40.0

Affected products

Go toolchain cmd/go
golang.org/x/mod golang.org/x/mod/sumdb/tlog

Classification

Weakness

CWE-347 Improper Verification of Cryptographic Signature

References

go.dev /cl/814960
web, patch
go.dev /cl/815020
web, patch
go.dev /issue/80744
web, report
groups.google.com /g/golang-announce/c/94pEornpRlI
web
pkg.go.dev /vuln/GO-2026-6179
web
nvd.nist.gov /vuln/detail/CVE-2026-56865
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary