CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB can serve undetected malicious module content, allowing attackers to execute arbitrary code via compromised dependencies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56864?
CVE-2026-56864 is a high-severity vulnerability in cmd/go, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Weakness: CWE-347
Which versions are affected by CVE-2026-56864?
3 open source packages ship an affected version, including golang, golang.org/x/mod and toolchain.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.13, 1.26.6, 1.27.0 |
golang.org/x/mod Go | All versions | 0.40.0 |
toolchain Go | All versions | 1.25.13, 1.26.6, 1.27.0-rc.3 |
How do I fix CVE-2026-56864?
Upgrade golang to a fixed version for your release line: 1.25.13, 1.26.6 or 1.27.0.
Is CVE-2026-56864 being exploited?
There is no known exploitation of CVE-2026-56864 in the wild and no public exploit code.
Sources
Also known as AZL-96659, AZL-96671, AZL-98577, BELL-CVE-2026-56864, BIT-golang-2026-56864, CLEANSTART-2026-BH69902 and 2134 more.