Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T22:17:22.677Z",
  "pubdate": "2026-08-13T22:17:22.677Z",
  "executiveSummary": "This vulnerability involves a security flaw in the interaction between Go proxy mechanisms and the Go checksum database (GOSUMDB). Specifically, a malicious GOSUMDB is capable of serving arbitrary module content that is not contained within the transparency log.\nThe primary impact of this flaw is that a coordinating GOPROXY and GOSUMDB can successfully serve malicious module content to a client without the tampering being detected by standard transparency log evaluation mechanisms.\nAffected systems include Go client environments utilizing vulnerable GOPROXY and GOSUMDB configurations.\nThe risk implication is severe, as developers relying on the integrity guarantees of the Go module checksum system may unknowingly execute or compile compromised dependencies.\nAttacker capabilities require coordination between a malicious GOPROXY and a malicious GOSUMDB to orchestrate the delivery of untrusted module content while bypassing cryptographic validation checks.\nExploitation requirements rely on the client querying the compromised proxy and checksum database infrastructure during module resolution and dependency retrieval operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the trust relationship between the Go client, the GOPROXY, and the GOSUMDB, where improper validation or coordination allows arbitrary module payloads to bypass transparency log checks.\nThe vulnerable component involves the Go module subsystem responsible for verifying downloaded module content against cryptographic hashes recorded in the GOSUMDB transparency log.\nExploitation occurs when an attacker controls or compromises both a GOPROXY and a GOSUMDB instance. During the dependency resolution phase, the coordinating GOPROXY serves malicious module content to the client.\nSimultaneously, the malicious GOSUMDB provides forged or unlogged cryptographic hash confirmations that prevent the Go client's verification routines from detecting a discrepancy between the downloaded payload and the expected transparency log records.\nBecause the transparency log evaluation fails to catch the untrusted content, the malicious module is accepted into the build environment as legitimate.\nAttack flow proceeds as follows: First, the client initiates a dependency fetch using go mod tidy or similar commands. Second, the client requests module data from the GOPROXY. Third, the compromised GOPROXY returns malicious module files. Fourth, the client queries the GOSUMDB for verification hashes. Fifth, the malicious GOSUMDB returns validation data that bypasses transparency log integrity checks, resulting in successful silent exploitation.\nPost-exploitation impact includes the potential execution of arbitrary code during the build process, supply chain compromise of software artifacts, and persistent integration of malicious dependencies into local and remote repositories."
}