CVE-2026-56865High· 8.8▾ TwilightA flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy (GOPROXY) could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go mod…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
8.8 → —
high → none
— → 8.8
none → high
8.8 → —
high → none
— → 8.8
none → high
8.8 → —
high → none
— → 8.8
none → high
0.1% → 0.1%
Last analysed / modified upstream
A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy (GOPROXY) could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparency log. This could lead to a supply chain compromise where users unknowingly incorporate compromised modules.
golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-05.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74609 If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. https://access.redhat.com/errata/RHSA-2026:67714
Workarounds / mitigations:
Affected packages:
toolchain >= 1.27.0-0, < 1.27.0-rc.3golang.org/x/mod < 0.40.0Patched in:
toolchain 1.27.0-rc.3golang.org/x/mod 0.40.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56864High· 8.1golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB (CVE-2026-56864)
CVE-2026-59887High· 7.5linkify-it: linkify-it: Denial of Service via crafted mailto: links (CVE-2026-59887)
CVE-2026-116189High· 7.5github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass (CVE-2026-116189)
CVE-2026-115374High· 7.1github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs (CVE-2026-115374)
CVE-2026-10579Critical· 9.8A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role
CVE-2024-52011High· 8.3launch-editor allows users to open files with line numbers in editor from Node.js