Description
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go toolchain | cmd/go | < 1.25.13, 1.26.0-0 – < 1.26.6, 1.27.0-0 – < 1.27.0-rc.3 | 1.25.13 |
| golang.org/x/mod | golang.org/x/mod/sumdb | < 0.40.0 | 0.40.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-1.26 | 1.26.6-1 | — |
| Debian 14 | golang-1.27 | 1.27~rc3-1 | — |
| Debian 13 | golang-1.24 | No fix yet | — |
| Debian 12 | golang-1.19 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | golang-1.23 +2 | No fix yet | — |
| Ubuntu 24.04 LTS | golang-1.21 +4 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-1.17 +7 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-1.13 +5 | No fix yet | — |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | golang-1.16 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | golang-1.13 +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | golang-1.13 +1 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES 15 SP7 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES 15 SP7 | go1.25-openssl | 1.25.14-150600.13.27.1 | SUSE-SU-2026:3815-1 |
| SLES 15 SP7 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES 15 SP7 | go1.26-openssl | 1.26.7-150600.13.15.1 | SUSE-SU-2026:3816-1 |
| SLES 15 SP7 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES 15 SP6 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES 15 SP6 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES 15 SP6 | go1.25-openssl | 1.25.14-150600.13.27.1 | SUSE-SU-2026:3815-1 |
| SLES 15 SP6 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES 15 SP6 | go1.26-openssl | 1.26.7-150600.13.15.1 | SUSE-SU-2026:3816-1 |
| SLES 15 SP6 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES 15 SP5 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES 15 SP5 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES 15 SP5 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLES 15 SP5 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES 15 SP5 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLES 15 SP5 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES 15 SP4 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES 15 SP4 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES 15 SP4 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLES 15 SP4 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES 15 SP4 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLES 15 SP4 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cosign | 3.1.3-160000.1.1 | SUSE-SU-2026:24213-1 |
| SLES for SAP 16.0 | go1.25 | 1.25.13-160000.1.1 | SUSE-SU-2026:23300-1 |
| SLES for SAP 16.0 | go1.25-openssl | 1.25.14-160000.1.1 | SUSE-SU-2026:23573-1 |
| SLES for SAP 16.0 | go1.26 | 1.26.6-160000.1.1 | SUSE-SU-2026:23301-1 |
| SLES for SAP 16.0 | go1.26-openssl | 1.26.7-160000.1.1 | SUSE-SU-2026:23576-1 |
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES for SAP 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLES for SAP 15 SP6 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES for SAP 15 SP6 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES for SAP 15 SP6 | go1.25-openssl | 1.25.14-150600.13.27.1 | SUSE-SU-2026:3815-1 |
| SLES for SAP 15 SP6 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES for SAP 15 SP6 | go1.26-openssl | 1.26.7-150600.13.15.1 | SUSE-SU-2026:3816-1 |
| SLES for SAP 15 SP6 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES for SAP 15 SP5 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES for SAP 15 SP5 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES for SAP 15 SP5 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLES for SAP 15 SP5 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES for SAP 15 SP5 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLES for SAP 15 SP5 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES for SAP 15 SP4 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLES for SAP 15 SP4 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLES for SAP 15 SP4 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLES for SAP 15 SP4 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLES for SAP 15 SP4 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLES for SAP 15 SP4 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLES 16.0 | cosign | 3.1.3-160000.1.1 | SUSE-SU-2026:24213-1 |
| SLES 16.0 | go1.25 | 1.25.13-160000.1.1 | SUSE-SU-2026:23300-1 |
| SLES 16.0 | go1.25-openssl | 1.25.14-160000.1.1 | SUSE-SU-2026:23573-1 |
| SLES 16.0 | go1.26 | 1.26.6-160000.1.1 | SUSE-SU-2026:23301-1 |
| SLES 16.0 | go1.26-openssl | 1.26.7-160000.1.1 | SUSE-SU-2026:23576-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLE Micro 6.2 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23973-1 |
| SLE Micro 6.1 | helm | 4.3.0-slfo.1.1_1.1 | SUSE-SU-2026:24282-1 |
| SLE HPC 15 SP5 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLE HPC 15 SP5 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLE HPC 15 SP5 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLE HPC 15 SP5 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLE HPC 15 SP5 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLE HPC 15 SP5 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
| SLE HPC 15 SP4 | cosign | 3.1.3-150400.3.57.1 | SUSE-SU-2026:4392-1 |
| SLE HPC 15 SP4 | go1.25 | 1.25.13-150000.1.50.1 | SUSE-SU-2026:3640-1 |
| SLE HPC 15 SP4 | go1.25-openssl | 1.25.14-150000.1.33.1 | SUSE-SU-2026:3800-1 |
| SLE HPC 15 SP4 | go1.26 | 1.26.6-150000.1.24.1 | SUSE-SU-2026:3641-1 |
| SLE HPC 15 SP4 | go1.26-openssl | 1.26.7-150000.1.18.1 | SUSE-SU-2026:3799-1 |
| SLE HPC 15 SP4 | go1.27 | 1.27.0-150000.1.6.1 | SUSE-SU-2026:3830-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cosign | 3.1.3-1.1 | openSUSE-SU-2026:11871-1 |
| openSUSE Tumbleweed | go1.25 | 1.25.13-1.1 | openSUSE-SU-2026:11516-1 |
| openSUSE Tumbleweed | go1.26 | 1.26.6-1.1 | openSUSE-SU-2026:11517-1 |
| openSUSE Tumbleweed | go1.27 | 1.27rc3-1.1 | openSUSE-SU-2026:11536-1 |
| openSUSE Tumbleweed | helm | 4.2.4-1.1 | openSUSE-SU-2026:11575-1 |
| openSUSE Leap 16.0 | cosign | 3.1.3-160000.1.1 | openSUSE-SU-2026:22064-1 |
| openSUSE Leap 16.0 | go1.25 | 1.25.13-160000.1.1 | openSUSE-SU-2026:21592-1 |
| openSUSE Leap 16.0 | go1.25-openssl | 1.25.14-160000.1.1 | openSUSE-SU-2026:21696-1 |
| openSUSE Leap 16.0 | go1.26 | 1.26.6-160000.1.1 | openSUSE-SU-2026:21593-1 |
| openSUSE Leap 16.0 | go1.26-openssl | 1.26.7-160000.1.1 | openSUSE-SU-2026:21705-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
| openSUSE Leap 16.0 | helm | 4.3.0-160000.1.1 | openSUSE-SU-2026:21983-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.26.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | golang +6 | 1.26.7-1.amzn2023.0.1 | ALAS2023-2026-2114 |
| Amazon Linux 2 | golang +6 | 1.26.7-1.amzn2.0.1 | ALAS2-2026-3893 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r69 | — |
| Wolfi rolling | cert-manager-cainjector-1.20 | 1.20.3-r18 | — |
| Wolfi rolling | cilium-1.19-operator-generic | 1.19.7-r7 | — |
| Wolfi rolling | containerd-1 | 1.7.34-r6 | — |
| Wolfi rolling | ctr-2 +3 | 2.3.4-r2 | — |
| Wolfi rolling | dogstatsd-7.79 +1 | 7.79.2-r18 | — |
| Wolfi rolling | dogstatsd-7.80 | 7.80.4-r26 | — |
| Wolfi rolling | dogstatsd-7.81 +2 | No fix yet | — |
| Wolfi rolling | falco-no-driver | 0.44.1-r5 | — |
| Wolfi rolling | helm-3 | 3.22.0-r0 | — |
| Wolfi rolling | k3d | 5.9.0-r8 | — |
| Wolfi rolling | k3s +1 | 1.36.3.1-r2 | — |
| Wolfi rolling | k3s-1.32 +2 | 1.32.13.1-r26 | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.10.1-r2 | — |
| Wolfi rolling | k3s-1.35 +1 | 1.35.7.1-r2 | — |
| Wolfi rolling | kots | 1.131.2-r1 | — |
| Wolfi rolling | kyverno-1.17 | 1.17.2-r35 | — |
| Wolfi rolling | kyverno-1.18 +5 | 1.18.2-r8 | — |
| Wolfi rolling | kyverno-cli-1.17 +4 | 1.17.2-r29 | — |
| Wolfi rolling | mps-control-daemon +2 | 0.19.3-r7 | — |
| Wolfi rolling | nerdctl | 2.3.5-r5 | — |
| Wolfi rolling | renovate | 44.115.4-r0 | — |
| Wolfi rolling | snyk-cli | 1.1306.4-r1 | — |
| Wolfi rolling | spire-agent | 1.15.2-r6 | — |
| Wolfi rolling | trino | 483-r7 | — |
| Wolfi rolling | zot | 2.1.20-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | golang.org/x/mod | < 0.40.0 | 0.40.0 | GO-2026-6180 |
| Go | toolchain | < 1.25.13 · >= 1.26.0-0, < 1.26.6 · >= 1.27.0-0, < 1.27.0-rc.3 | 1.25.13, 1.26.6, 1.27.0-rc.3 | GO-2026-6180 |
Advisories 32
- WID-SEC-2026-2850 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:24282-1 Security update for helm SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24213-1 Security update for cosign SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22064-1 Security update for cosign SUSE / openSUSE Security Updates · Oct 19, 2026
- SUSE-SU-2026:23984-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23973-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21983-1 Security update for helm SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:4392-1 Security update for cosign SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23573-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23576-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:11871-1 cosign-3.1.3-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
- SUSE-SU-2026:23300-1 Security update for go1.25 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:23301-1 Security update for go1.26 SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026
- SUSE-SU-2026:3830-1 Security update for go1.27 SUSE / openSUSE Security Updates · Aug 31, 2026
- SUSE-SU-2026:3816-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Aug 31, 2026
- SUSE-SU-2026:3815-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Aug 31, 2026
- openSUSE-SU-2026:21705-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Aug 31, 2026
- openSUSE-SU-2026:21696-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Aug 31, 2026
- ALAS2-2026-3893 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- ALAS2023-2026-2114 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- SUSE-SU-2026:3799-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:3800-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media SUSE / openSUSE Security Updates · Aug 23, 2026
- openSUSE-SU-2026:21592-1 Security update for go1.25 SUSE / openSUSE Security Updates · Aug 21, 2026
- openSUSE-SU-2026:21593-1 Security update for go1.26 SUSE / openSUSE Security Updates · Aug 21, 2026
- openSUSE-SU-2026:11536-1 go1.27-1.27rc3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 19, 2026
- SUSE-SU-2026:3640-1 Security update for go1.25 SUSE / openSUSE Security Updates · Aug 18, 2026
- SUSE-SU-2026:3641-1 Security update for go1.26 SUSE / openSUSE Security Updates · Aug 18, 2026
- openSUSE-SU-2026:11516-1 go1.25-1.25.13-1.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
- openSUSE-SU-2026:11517-1 go1.26-1.26.6-1.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026