CVE-2026-42501
HighSummary
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This affects users using untrusted module proxies or checksum databases.
Risk Assessment
This vulnerability can lead to downloading and executing altered versions of the Go toolchain, posing a serious threat to the security of applications and systems using this tool.
Recommendation
It is recommended to upgrade the base Go toolchain and avoid using untrusted module proxies and checksum databases.
Other vulnerabilities in Go toolchain
See all- CVE-2026-94447High
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY could bypass the intended checksum. It is now ensured that golang.org/toolchain always goes to the network for the canonical checksum.
- CVE-2026-94444High
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY could serve an arbitrary module in its place. The trusted ziphash for the bundled golang.org/fips140 module is now unpacked and its entry in GOMODCACHE is constructed so it can be verified by the toolchain.
Original NVD description (English source)
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions
Vulnerability data from NVD (NIST) · CISA KEV · EPSS