GO-2026-6180

    Dashboard / Vulnerabilities / GO-2026-6180

    GO-2026-6180

    Published: 13 Aug 2026Last Modified: 19 Aug 2026

    Summary: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

    Details: A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

    References: https://go.dev/issue/80745, https://groups.google.com/g/golang-announce/c/94pEornpRlI, https://go.dev/cl/815000, https://go.dev/cl/815020

    Affected packages

    Package

    Name: toolchain

    Purl: pkg:golang/toolchain

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.25.13

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High