Go x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
The Go project has released golang.org/x/mod v0.40.0 to close two vulnerabilities in the module checksum database client that could let malicious infrastructure serve undetected module content.
CVE-2026-56865 is a transparency-log tile verification bypass. A malicious GOPROXY could forge up to two sumdb tiles so a requested module skipped the GOSUMDB check and left attacker-controlled bytes in the local module cache. Tile data is now verified against parent tiles end to end. Filippo Valsorda of Geomys reported the issue.
CVE-2026-56864 concerns Lookup handling of unrelated hashes. A malicious GOSUMDB could return arbitrary module content that never appeared in the transparency log. Together with a cooperating proxy, that content could reach clients without failing log evaluation. The reporter is credited as mundur.
Both attacks defeat the intended guarantee that clients can detect tampering by checking the public sum database. Users who want to re-validate their trees are advised to remove go.sum, go.work.sum, and vendor/, then rerun go mod tidy. The Go Security team announced the fixes on the golang-nuts list.