Description

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-13T22:17:22.797Z",
  "pubdate": "2026-08-13T22:17:22.797Z",
  "executiveSummary": "A critical vulnerability existed in Go module handling where a malicious GOPROXY could forge up to two sumdb tiles. This flaw allowed requested modules to completely bypass the GOSUMDB integrity check and persist attacker-controlled module content directly into the local Go module cache.\nThe vulnerability directly impacts systems utilizing untrusted Go module proxies and performing dependency resolution. Risk implications include potential supply chain compromise through the execution of arbitrary, unverified code during the build or execution phases of Go applications.\nAttacker capabilities are limited to serving malicious module content that evades detection by transparency log evaluations due to the tile verification failure. Exploitation requires a compromised or malicious GOPROXY interacting with a vulnerable Go client during module retrieval.\nRemediation involves ensuring that Go tooling correctly verifies all sumdb tiles against their parent nodes. Users can determine if their local environments have been affected by executing the command rm -r go.sum go.work.sum vendor/ && go mod tidy.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient cryptographic validation within the Go sumdb tile verification mechanism. Specifically, the Go module client failed to properly verify all retrieved sumdb tiles against their respective parent nodes in the transparency log hierarchy.\nThe vulnerable component is the Go module subsystem responsible for verifying cryptographic hashes of downloaded modules against the Go checksum database (GOSUMDB).\nDuring the attack flow, a malicious GOPROXY intercepts module requests and serves crafted responses containing forged sumdb tiles. Because the client fails to enforce complete hierarchical verification for up to two specific tiles, the verification logic accepts the invalid cryptographic proofs as authentic.\nConsequently, the Go client bypasses the expected GOSUMDB check for the requested module. The attacker-controlled module content is then accepted, processed, and persisted into the local Go module cache without raising integrity warnings.\nSubsequent compilation or execution of the affected Go project utilizes the cached, malicious module content. This results in arbitrary code execution or supply chain compromise within the developer environment or build pipeline.\nNetwork exposure is inherent to the use of external Go proxies over public or untrusted networks. No specific authentication or privilege requirements are necessary for the malicious GOPROXY beyond being positioned to intercept or serve module traffic to the victim client."
}