CVE-2026-94444
UnknownSummary
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY could serve an arbitrary module in its place. The trusted ziphash for the bundled golang.org/fips140 module is now unpacked and its entry in GOMODCACHE is constructed so it can be verified by the toolchain.
Risk Assessment
Replacing the fips140 module with an arbitrary module can lead to execution of untrusted code and compromise of cryptographic security.
Recommendation
Update Go to a version with the fix and avoid using untrusted GOMODPROXY.
Other vulnerabilities in Go toolchain
See all- CVE-2026-94447Unknown
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY could bypass the intended checksum. It is now ensured that golang.org/toolchain always goes to the network for the canonical checksum.
- CVE-2026-42501High
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This affects users using untrusted module proxies or checksum databases.
Original NVD description (English source)
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS