| id: GO-2026-6602 | |
| modules: | |
| - module: cmd | |
| versions: | |
| - fixed: 1.26.9 | |
| - introduced: 1.27.0-0 | |
| - fixed: 1.27.2 | |
| vulnerable_at: 1.27.1 | |
| packages: | |
| - package: cmd/go | |
| summary: Checksum database bypass for golang.org/toolchain in cmd/go | |
| description: |- | |
| Previously, a user operating inside of a malicious | |
| Go project that defines a bogus golang.org/toolchain | |
| go.sum entry and operates a malicious GOMODPROXY the | |
| user chooses to use can bypass the intended checksum. | |
| We now ensure that golang.org/toolchain always goes | |
| to the network for the canonical checksum. | |
| references: | |
| - fix: https://go.dev/cl/840785 | |
| - report: https://go.dev/issue/81834 | |
| - web: https://groups.google.com/g/golang-announce/c/U2fTuyDJznI | |
| cve_metadata: | |
| id: CVE-2026-94447 | |
| cwe: 'CWE-354: Improper Validation of Integrity Check Value' | |
| source: | |
| id: go-security-team | |
| created: 2026-10-08T00:00:00Z | |
| review_status: REVIEWED |