# CVE-2026-42501: Google Go checksum validation bypass in cmd/go

Source: https://junglewise.ai/threats/cve-2026-42501-google-go-checksum-validation-bypass-in-cmd-go  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42501 · Severity: high · CVSS 7.5 · Published 2026-05-07

A vulnerability in the Go programming language's command-line tool allows a malicious module proxy to bypass security checks when downloading software dependencies or toolchain updates. If an attacker controls the proxy server used by a developer, they could serve modified, malicious versions of the Go toolchain or libraries that the developer's computer will then execute. This could lead to a full system compromise or the introduction of backdoors into the developer's own software projects.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42501 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42501 being exploited in the wild.

**How severe is CVE-2026-42501?** High severity, with a CVSS score of 7.5, published 7 May 2026.

**Which products and versions are affected?** toolchain (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.

**Is there a fix for CVE-2026-42501?** Yes. toolchain (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42501 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42501?** Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toolchain (Go): upgrade to 1.26.3 or later

  ```sh
  go get toolchain@v1.26.3
  ```


## Technical details

The Go command (cmd/go) fails to properly validate responses from the checksum database (GOSUMDB) when a module is not already present in the go.sum file. Specifically, if a module proxy returns a successful response that contains no entry for the requested module, or a response for an unrelated module, the go command incorrectly permits validation to succeed. This allows a malicious proxy to serve altered versions of the Go toolchain or modules. Because the go command may automatically download new toolchains based on GOTOOLCHAIN settings or go.mod directives, this can result in the execution of untrusted code. The vulnerability is addressed in Go versions 1.25.10 and 1.26.3.

## Affected products

- Google Go < 1.25.10, >= 1.26.0 < 1.26.3

## Identifiers

- CVE-2026-42501
- GO-2026-4984

## Timeline

- 2026-04-30: disclosed: Issue opened on GitHub
- 2026-05-07: advisory: CVE published and Go vulnerability report released

## References

- [https://go.dev/cl/775321](https://go.dev/cl/775321)
- [https://go.dev/issue/79070](https://go.dev/issue/79070)
- [https://groups.google.com/g/golang-announce/c/qcCIEXso47M](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)
- [https://pkg.go.dev/vuln/GO-2026-4984](https://pkg.go.dev/vuln/GO-2026-4984)

## Related threats

- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)
- [Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives)