Go 1.27 RC3 plugs module proxy checksum bypasses

Go 1.27rc3 is out with ten security fixes. The most serious close holes in module checksum verification that could let a malicious proxy or checksum database deliver attacker-controlled module content without detection by the transparency log.

In the sumdb tile verifier, a hostile GOPROXY could previously forge up to two tiles so a requested module skipped the GOSUMDB check and landed attacker-chosen content in the local module cache. All tiles are now checked against their parents. Filippo Valsorda of Geomys reported the issue (CVE-2026-56865).

Separately, Lookup in the sumdb client could accept unrelated, unauthenticated hashes. A malicious GOSUMDB, working with a cooperating proxy, could therefore serve module content that never appeared in the log (CVE-2026-56864). The reporter is credited as mundur.

Anyone worried about prior exposure is advised to wipe go.sum, go.work.sum, and vendor, then re-run go mod tidy so dependencies are re-resolved against a fixed toolchain.

Other fixes in the candidate include a recursion depth guard in encoding/xml DecodeElement, which previously reset its counter and could exhaust the stack (CVE-2026-56859), and application of ReadHeaderTimeout when a server peeks at new connections for the unencrypted HTTP/2 client preface, closing a path that had no timeout (CVE-2026-56853).

The candidate is cut from the Go 1.27 release branch for testing ahead of the final 1.27 release.