## Summary
A malicious GOPROXY could previously forge up to two sumdb tiles, enabling a requested module to bypass the GOSUMDB check and persist attacker-controlled module content into the local Go module cache. This could allow malicious module content to be served without being detected via transparency log evaluation. All tiles are now correctly verified against their parents.
## Technical Details
- The issue is tracked as Go issue https://go.dev/issue/80744 and corresponds to CVE-2026-56865.
- Attack mechanism (as described): a malicious GOPROXY could forge up to two sumdb tiles.
- Resulting behavior: the forged tiles could allow a module request to bypass the GOSUMDB check and write attacker-controlled module content into the local module cache.
- Detection/evasion: the malicious content could not be detected by evaluating the transparency log (per the NVD description).
- Fix status: “All tiles are now correctly verified against their parents.”
## Affected
- Go environments that rely on GOPROXY/GOSUMDB behavior prior to the corrected tile verification.
- The reference provides a local verification procedure to determine exposure.
## Impact
- Confidentiality/Integrity/Availability impact are indicated by the provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Attacker-controlled module content can be persisted to the local Go module cache, potentially leading to malicious code execution during builds (implied by module cache persistence).
## Mitigation
1. Run the provided check to determine if you are affected: rm -r go.sum go.work.sum vendor/ && go mod tidy.
2. Ensure your Go toolchain includes the corrected behavior where sumdb tiles are “correctly verified against their parents” (per the issue statement).
3. Reduce trust in untrusted proxies by using a trusted GOPROXY configuration so a malicious proxy cannot forge sumdb tiles.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-347