IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta

CVE-2026-94444Checksum bypass for golang.org/fips140 in cmd/go

Go toolchain cmd/go Publicada: (hace 1 mes)

Descripción

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

Debilidad (CWE): CWE-354

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Go toolchain cmd/go < 1.26.9, 1.27.0-0 – < 1.27.2

Referencias y parches

CVE recientes del mismo producto — Go

Sin puntuación
CVE-2026-97054

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …