Go 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks

The Go project has released versions 1.26.6 and 1.25.13, minor updates that include ten security fixes. The most serious affect how the toolchain verifies modules against the public checksum database when fetching code through a proxy.

A flaw in sumdb tile verification let a malicious GOPROXY forge up to two transparency-log tiles. That was enough for a requested module to skip the GOSUMDB check and leave attacker-controlled content in the local module cache, content that later inspection of the log would not reveal. All tiles are now checked against their parents. Filippo Valsorda of Geomys reported the issue, tracked as CVE-2026-56865.

A related bug in sumdb Lookup allowed a malicious GOSUMDB to return arbitrary module content outside the transparency log. A cooperating proxy and checksum service could therefore hand a client malicious modules that still looked clean when the log was evaluated. That is CVE-2026-56864, reported by mundur.

Users who want to check whether a compromised cache may already be present can remove go.sum, go.work.sum, and vendor directories, then re-run go mod tidy.

Other fixes harden the standard library against denial-of-service. encoding/xml now enforces a recursion depth limit during decode; a counter reset had previously prevented the guard from ever firing, risking stack exhaustion (CVE-2026-56859). net/http applies ReadHeaderTimeout when probing new connections for the unencrypted HTTP/2 client preface, closing a path that previously ran with no timeout (CVE-2026-56853). net/url also addresses quadratic complexity in path resolution.

Anyone building or deploying Go programs that fetch modules over the network, or that parse untrusted XML or URLs, should move to the new point releases.