Whenever somebody argues that Go's package ecosystem is structurally safer than npm or PyPI, the argument ends up at the same place: the checksum database. Every module Go downloads gets checked against sum.golang.org, a public append-only transparency log, and the theory is that swapping a package for a poisoned one cannot be done quietly because the log would show it. On August 13 the Go security team patched two flaws in exactly that mechanism.
The advisory went out on the golang-announce list with the tag of golang.org/x/mod v0.40.0, and it is worth quoting rather than paraphrasing.
The tile forgery
The first, CVE-2026-56865, sits in the transparency log code itself. "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache." Tiles are the chunks the log is served in, and the problem was that they were not being checked against their parents, so a hostile proxy could fabricate a couple of them and walk a module through the gate. The team is direct about what that buys an attacker: it "allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log." The fix is one line in the notes. "All tiles are now correctly verified against their parents."
It was reported by Filippo Valsorda of Geomys, who used to run Go's own security work, which tells you something about the level of familiarity needed to spot it.
The unauthenticated hash
The second, CVE-2026-56864, is in the sumdb lookup path, which was accepting unrelated and unauthenticated hashes. In the advisory's words, "a malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log", and chained with the first, "a coordinating GOPROXY and GOSUMDB" can hand a client malicious content that evaluating the log will not reveal. It was reported by a researcher credited only as mundur.
Be clear about what this requires
This is not a bug that lets a random attacker poison your build. Both flaws need hostile infrastructure: the first a malicious or compromised module proxy, the second a malicious checksum database as well. If you pull modules straight from the public proxy and the public sum database, an attacker needs to be in one of those positions first.
The population that should actually care is the one running its own plumbing. Plenty of organisations point GOPROXY at a private mirror or an artifact repository, precisely because they want control over what enters the build, and quite a few set GOSUMDB or GOPRIVATE in ways that reduce checking. If any of that infrastructure can be compromised, these bugs describe how a compromise there becomes module content sitting in a developer's cache with the checksum database none the wiser.
What you should do
Update golang.org/x/mod to v0.40.0. The Go security team also published a separate announcement the same evening for Go 1.26.6 and Go 1.25.13, carrying ten security fixes across the toolchain, so take that too, but do not conflate the two: the point releases were not issued for these two CVEs alone.
One detail is being misread already, so read it carefully. The advisory offers the command "rm -r go.sum go.work.sum vendor/ && go mod tidy" under the heading "In order to determine if you have been affected". That is a diagnostic, a way of re-resolving your dependencies against a fixed toolchain and seeing whether anything changes. It is not the remediation. Upgrading is. Neither advisory carries a CVSS score or a severity rating, and neither says anything about exploitation in the wild.
Here is the part that stays with me. This is the second checksum-database bypass Go has patched this year, and mundur reported that one too: CVE-2026-42501, published in May, where a malicious module proxy could bypass checksum validation for a downloaded Go toolchain, meaning the proxy could serve you an altered version of Go itself. Two bypasses, two disclosures, one recurring reporter, in the mechanism the whole ecosystem cites as the reason it is the well-designed one. Supply chain stories usually look like 993 fake npm packages aimed at a single bank or an AI dependency leaking 2,500 companies' secrets, which are loud and easy to see. This is the quiet kind, in the layer built to catch the loud kind, and somebody is clearly still looking.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.