Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade go-toolsetUpgrade golangUpgrade golang-binUpgrade golang-docsUpgrade golang-srcUpgrade golang-miscUpgrade delveUpgrade golang-raceUpgrade golang-tests | Oct 25, 2026 | Oct 20, 2026 |
| Alpine Linux | — | Upgrade go | Oct 15, 2026 | Oct 8, 2026 |
| Redhat_linux | — | Upgrade delve-debuginfoUpgrade delveUpgrade go-toolsetUpgrade golang-docsNo solution existsUpgrade golang-srcUpgrade golang-binUpgrade golang-miscUpgrade golangUpgrade delve-debugsourceUpgrade golang-raceUpgrade golang-tests | Oct 13, 2026 | Oct 8, 2026 |
| Rocky_linux | — | Upgrade delve-debuginfoUpgrade golangUpgrade golang-binUpgrade golang-raceUpgrade delve-debugsourceUpgrade go-toolsetUpgrade delve | Oct 26, 2026 | Oct 21, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub