PT-2026-38570 · Google+1 · Go+1
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Go (affected versions not specified)
Description
A flaw in the
go command's validation of module checksums allows a malicious module proxy to bypass checksum database validation. This occurs when the checksum database returns a successful response that contains no entry for the module, leading the go command to incorrectly permit validation to succeed. Consequently, a malicious proxy can serve altered versions of the Go toolchain or modules. This is particularly critical when a different toolchain version is selected via the GOTOOLCHAIN environment variable, a go.work file, or a go.mod file, as the go command will download and execute the toolchain provided by the proxy. The issue affects users utilizing an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB).Recommendations
Upgrade the base Go toolchain.
Users with a non-trusted
GOPROXY can revalidate all dependencies of the current module by running "rm go.sum ; go mod tidy ; go mod verify".Exploit
Fix
DoS
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Go
Red Os