)]}'
{
  "commit": "57549bfb0d25b5ff7eb4763aa1f029d7e5383232",
  "tree": "583b88c173480f91110b52a0c06fa8a8077b76ec",
  "parents": [
    "96f62ae6e9cb1b123de383fa2542812c9ba3b7db"
  ],
  "author": {
    "name": "Roland Shoemaker",
    "email": "roland@golang.org",
    "time": "Fri Jul 24 10:29:06 2026 -0700"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu Aug 13 12:00:00 2026 -0700"
  },
  "message": "sumdb: ignore unrelated hashes in Lookup\n\nDuring Lookup, if the server returns a validly signed record for an\nunrelated module which contains in the signed tree head another hash\nfor the module which was requested in the \"extension\" portion of the\nsigned tree head (anything following the tree hash, but before the\nsignatures), _only_ the unrelated hashes are validated by checking the\nrelevant tiles, ignoring the portion in the tree head.\n\nLookup would then look for hash lines which match the requested module\npath in the fully returned record, not just the validated portion,\ncausing only the hash appended to the tree head portion to be returned.\n\nThis would allow a malicious sumdb instance to return a validly signed\nresponse for a module from which Lookup would return a hash which is not\nactually present in the tree. This would allow a conspiring malicious\nsumdb and module proxy (or a module proxy which is proxying the sumdb\n_and has the sumdb key_) to serve malicious module content which is not\nrecorded in the transparency log.\n\nThe fix is quite simple, instead of caching the full record, we only\ncache the hash lines returned by tlog.ParseRecord, which are validated.\nLookup will then only extract matching hashes from the validated\nportion, instead of the full record.\n\nThanks to Mundur (https://github.com/M0nd0R) for reporting this issue.\n\nFixes CVE-2026-56864\nFixes golang/go#80745\n\nChange-Id: I4a418620e8e4e8ab5f7ec41b0ed443a92e9be6e1\nReviewed-on: https://go-review.googlesource.com/c/mod/+/815000\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "47533a843d6345596cdf3499cd032ccb8af6593e",
      "old_mode": 33188,
      "old_path": "sumdb/client.go",
      "new_id": "25df2cdbdf0e85ddf7773fc4138f92e4e465609d",
      "new_mode": 33188,
      "new_path": "sumdb/client.go"
    },
    {
      "type": "modify",
      "old_id": "f085e7d5b1e92e81d598b33baf863c9e53ba8989",
      "old_mode": 33188,
      "old_path": "sumdb/client_test.go",
      "new_id": "b884d60bc6cb9503e33e77b336d7fc9c0fcb5cac",
      "new_mode": 33188,
      "new_path": "sumdb/client_test.go"
    }
  ]
}