https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:51:16 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:22112 <p><strong>Affected:</strong> AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests</p> <p>Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.</p> <p>Security Fix(es):</p> <p>* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go &#39;go bug&#39; command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)</p> <p>For more details about the security issue(s), including t…</p> <p><strong>Affected:</strong> AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests</p> <p>Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.</p> <p>Security Fix(es):</p> <p>* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go &#39;go bug&#39; command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)</p> <p>For more details about the security issue(s), including t…</p> https://cve.radiocsirt.org/vuln/alsa-2026:22112 https://cve.radiocsirt.org/vuln/bdu:2026-08061 bdu:2026-08061 https://cve.radiocsirt.org/vuln/bdu:2026-08061 https://cve.radiocsirt.org/vuln/bell-cve-2026-42501 <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-42501 https://cve.radiocsirt.org/vuln/bit-golang-2026-42501 <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> https://cve.radiocsirt.org/vuln/bit-golang-2026-42501 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0888 certfr-2026-avi-0888 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0888 https://cve.radiocsirt.org/vuln/cleanstart-2026-ab44357 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opentofu-fips</p> <p>Package opentofu-fips version 1.9.4-r6 fixes 13 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opentofu-fips</p> <p>Package opentofu-fips version 1.9.4-r6 fixes 13 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ab44357 https://cve.radiocsirt.org/vuln/euvd-2026-309179 EUVD-2026-309179 https://cve.radiocsirt.org/vuln/euvd-2026-309179 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42501 <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42501 https://cve.radiocsirt.org/vuln/ghsa-qf3q-3h68-mmh2 <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> https://cve.radiocsirt.org/vuln/ghsa-qf3q-3h68-mmh2 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42501 msrc_CVE-2026-42501 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42501 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10723-1 <p>go1.25-1.25.10-1.1 on GA media</p> <p>go1.25-1.25.10-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10723-1 https://cve.radiocsirt.org/vuln/rhsa-2026:23262 <p>crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header net/textproto: golang: Golang net/textproto: Misleading error messages via input injection golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation</p> <p>crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header net/textproto: golang: Golang net/textproto: Misleading error messages via input injection golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:23262 https://cve.radiocsirt.org/vuln/rlsa-2026:22112 <p><strong>Affected:</strong> Rocky Linux:8: delve, Rocky Linux:8: golang</p> <p>Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.</p> <p>Security Fix(es):</p> <p>* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)</p> <p>* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)</p> <p>* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)</p> <p>* cmd/go: golang: Go &#39;go bug&#39; command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)</p> <p>* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)</p> <p>* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)</p> <p>* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)</p> <p>* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)</p> <p>* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)</p> <p>* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)</p> <p>* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)</p> <p>For more details about the security issue(s), including the impact, a CVSS…</p> <p><strong>Affected:</strong> Rocky Linux:8: delve, Rocky Linux:8: golang</p> <p>Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.</p> <p>Security Fix(es):</p> <p>* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)</p> <p>* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)</p> <p>* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)</p> <p>* cmd/go: golang: Go &#39;go bug&#39; command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)</p> <p>* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)</p> <p>* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)</p> <p>* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)</p> <p>* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)</p> <p>* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)</p> <p>* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)</p> <p>* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)</p> <p>For more details about the security issue(s), including the impact, a CVSS…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:22112 https://cve.radiocsirt.org/vuln/suse-su-2026:21804-1 <p>Security update for go1.26</p> <p>Security update for go1.26</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21804-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42501 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>A malicious module proxy can exploit a flaw in the go command&#39;s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module&#39;s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running &#34;rm go.sum ; go mod tidy ; go mod verify&#34;, which will revalidate all dependencies of the current module. The specific flaw in more detail: The g…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42501 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1437 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1437