Is CVE-2026-56865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56865 being exploited in the wild.

How severe is CVE-2026-56865?

High severity, with a CVSS score of 8.4, published 13 August 2026.

Which products and versions are affected?

golang.org/x/mod (Go) SEMVER:introduced=0,fixed=0.40.0; toolchain (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.

Is there a fix for CVE-2026-56865?

Yes. golang.org/x/mod (Go): upgrade to 0.40.0 or later; toolchain (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56865 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56865?

Check whether you run golang.org/x/mod (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56865: Go malicious GOPROXY sumdb tile forgery bypass

CVE-2026-56865 · Severity: high · CVSS 8.4 · Published 2026-08-13

Go developers rely on a transparency log (GOSUMDB) to verify that downloaded software modules have not been tampered with. A malicious proxy server could forge verification data to trick developers into caching compromised code that would pass the security check. This could allow attackers to inject malware into developers' local environments that would persist across builds.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-56865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56865 being exploited in the wild.
How severe is CVE-2026-56865?: High severity, with a CVSS score of 8.4, published 13 August 2026.
Which products and versions are affected?: golang.org/x/mod (Go) SEMVER:introduced=0,fixed=0.40.0; toolchain (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.
Is there a fix for CVE-2026-56865?: Yes. golang.org/x/mod (Go): upgrade to 0.40.0 or later; toolchain (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56865 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56865?: Check whether you run golang.org/x/mod (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/mod (Go): upgrade to 0.40.0 or later
```
go get golang.org/x/mod@v0.40.0
```
toolchain (Go): upgrade to 1.27.0-rc.3 or later
```
go get toolchain@v1.27.0-rc.3
```

Technical details

The vulnerability exists in Go's sumdb (sum database) tile verification logic. A malicious GOPROXY server could forge up to two sumdb tiles, allowing a requested module to bypass GOSUMDB verification checks and persist attacker-controlled content in the local Go module cache. The root cause is incomplete verification of tiles against their parent entries in the transparency log, permitting an attacker to inject false verification data. The attack requires network access to a compromised or attacker-controlled GOPROXY. Go modules downloaded through such a proxy could be cached locally with forged verification checksums that appear valid. The issue has been patched; tiles are now correctly verified against their parents.

Affected products

Google Go prior to fix (2026-08-13)

Identifiers

CVE-2026-56865
GO-2026-6179

Timeline

2026-08-13: disclosed: CVE-2026-56865 disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.