Repository navigation
cmd/go: malicious GOMODPROXY can cause golang.org/toolchain checksum bypass #81834
Description
cmd/go: checksum database bypass for golang.org/toolchain
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/toolchain
go.sum entry and operates a malicious GOMODPROXY the
user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes
to the network for the canonical checksum.
This is CVE-2026-94447 and Go issue https://go.dev/issue/81834.
This was a PUBLIC track issue originally tracked in http://b/547888895.
Activity
gopherbot commentedon Sep 28, 2026
Change https://go.dev/cl/840785 mentions this issue:
cmd/go: always verify toolchain downloads with sumdbthatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81913 (for 1.26), #81914 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843587 mentions this issue:
[release-branch.go1.27] cmd/go: always verify toolchain downloads with sumdbgopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843745 mentions this issue:
[release-branch.go1.26] cmd/go: always verify toolchain downloads with sumdbcmd/go: always verify toolchain downloads with sumdb
[release-branch.go1.26] cmd/go: always verify toolchain downloads wit…
[release-branch.go1.27] cmd/go: always verify toolchain downloads wit…