Go 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
Go 1.26.6 and 1.25.13 are out as minor point releases carrying ten security fixes. The most consequential ones weaken the trust model around module proxies and the checksum database.
A malicious GOPROXY could previously forge up to two sumdb tiles so that a requested module bypassed the GOSUMDB check and left attacker-controlled content in the local module cache. The injection would not show up when evaluating the transparency log. All tiles are now verified against their parents. Filippo Valsorda of Geomys reported the issue, tracked as CVE-2026-56865.
Separately, a malicious GOSUMDB could serve arbitrary module content that never appeared in the transparency log. A coordinating proxy and sumdb could therefore deliver malicious modules that ordinary log checks would miss. That is CVE-2026-56864, reported by mundur.
Anyone who wants to check for prior impact can delete go.sum, go.work.sum, and any vendor directory, then re-run go mod tidy.
Among the other fixes: encoding/xml decoding now enforces a recursion depth limit that previously failed to trigger, which could exhaust the stack (CVE-2026-56859). Servers that accept unencrypted HTTP/2 now apply ReadHeaderTimeout while reading the client preface, closing a window with no timeout (CVE-2026-56853). Path resolution in net/url no longer exhibits quadratic complexity.
The releases follow the project’s usual security policy for point updates.