Repository navigation
cmd/go: malicious GOMODPROXY can cause golang.org/fips140 checksum bypass #81833
Description
cmd/go: checksum bypass for golang.org/fips140
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/fips140
and operates a malicious GOMODPROXY the user chooses
to connect to can serve an arbitrary module in its
place.
We now unpack the trusted ziphash for the bundled
golang.org/fips140 module and construct its entry
in the GOMODCACHE such that it can be verified by
the toolchain.
This is CVE-2026-94444 and Go issue https://go.dev/issue/81833.
This was a PUBLIC track issue originally tracked in http://b/552479602.
Activity
gopherbot commentedon Sep 28, 2026
Change https://go.dev/cl/840685 mentions this issue:
cmd/go: install FIPS snapshot zip hashesthatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81911 (for 1.26), #81912 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843646 mentions this issue:
[release-branch.go1.27] cmd/go: bundle go.sum h1 hashes for golang.org/fips140gopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843725 mentions this issue:
[release-branch.go1.26] cmd/go: bundle go.sum h1 hashes for golang.org/fips140cmd/go: bundle go.sum h1 hashes for golang.org/fips140
[release-branch.go1.27] cmd/go: bundle go.sum h1 hashes for golang.or…
[release-branch.go1.26] cmd/go: bundle go.sum h1 hashes for golang.or…