Vulnerabilities

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious…

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Canonical

Product

canonical

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-94447 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 5
   CVE NVD 23d ago

   Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user…

   CVE-2026-94444