IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Go toolchain cmd/go; golang.org/x/mod golang.org/x/mod/sumdb Publicada: (hace 2 meses)

Descripción

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Debilidad (CWE): CWE-347

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Go toolchain cmd/go < 1.25.13, 1.26.0-0 – < 1.26.6, 1.27.0-0 – < 1.27.0-rc.3
golang.org/x/mod golang.org/x/mod/sumdb < 0.40.0

Referencias y parches

CVE recientes del mismo producto — Go

Sin puntuación
CVE-2026-97054

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …