Go patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
The Go project has released golang.org/x/mod version 0.40.0 to fix two security flaws that let a malicious module proxy and checksum database deliver attacker-controlled packages without detection by the sumdb transparency log.
CVE-2026-56865 allowed a hostile GOPROXY to forge up to two sumdb tiles so a requested module could bypass the GOSUMDB check and land attacker-controlled content in the local module cache. Evaluating the transparency log would not reveal the tampering. All tiles are now verified against their parents. Filippo Valsorda of Geomys reported the issue.
CVE-2026-56864 allowed a malicious GOSUMDB to serve arbitrary module content that was never present in the transparency log. A coordinating GOPROXY and GOSUMDB could therefore push bad modules that log inspection would not flag. Lookup now ignores unrelated, unauthenticated hashes. The issue was reported by mundur.
Both flaws matter for anyone who fetches modules through untrusted or compromised proxy and sumdb endpoints: the cache could retain content that the checksum machinery was meant to reject. The Go Security team advises removing go.sum, go.work.sum, and vendor, then running go mod tidy, to see whether a workspace was affected.