Skip to content

CVE-2026-56864 on CTRL-OS 26.05

Aliases: CVE-2026-56864

Packages: go_1_27

Status: In Progress, Resolved

Advisory Information

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Updates

2026-08-17 11:43 CEST

Metadata changes:

  • Status for package go_1_27: “Resolved” (e5bcd467cf926a27830bf0bced347f434271ac0c)

2026-08-17 11:41 CEST

Metadata changes:

  • Status for package go: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)
  • Status for package go_1_26: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)

2026-08-17 11:39 CEST

Metadata changes:

  • Status for package go_1_25: “Resolved” (95b632a8007bdaebc2c08b6e07292702eceade51)

Comment:

Fixed by updating to Go 1.25.3.

2026-08-17 11:38 CEST

Metadata changes:

  • Status for package go: “Acknowledged”
  • Status for package go_1_25: “Acknowledged”
  • Status for package go_1_26: “Acknowledged”