This vulnerability (CVE-2026-42501) in the Go toolchain's cmd/go component involves improper verification of cryptographic signatures (CWE-347) during module checksum validation. When the go command queries the checksum database for a module not listed in go.sum, it expects a cryptographically signed checksum. However, if the checksum database returns a successful response with no entry, the go command incorrectly treats this as valid. A malicious module proxy can exploit this by returning empty or unrelated checksum responses, causing the go command to accept altered modules or toolchains. This affects users who use untrusted GOPROXY or GOSUMDB settings. The vulnerability allows bypassing checksum validation, undermining the integrity of downloaded modules and toolchains. The go tool does validate hashes before execution, but this flaw can cause incorrect hashes to be recorded in go.sum, potentially leading to execution of tampered code. No patch or official remediation has been confirmed at this time.

The vulnerability allows a malicious module proxy to bypass checksum database validation, enabling it to serve altered versions of Go modules or the Go toolchain. This can lead to execution of tampered code, compromising the integrity and security of the Go development environment. Since the go command trusts go.sum files for module hashes, a compromised proxy can cause incorrect hashes to be recorded, potentially affecting builds and deployments. Users relying on untrusted proxies or checksum databases are at risk. However, the go tool validates hashes before executing toolchains, which mitigates some risk for cached toolchains. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users are advised to upgrade their base Go toolchain once a fixed version is released, as setting GOTOOLCHAIN to a fixed version alone is insufficient. To detect potential compromise, users who have configured a non-trusted GOPROXY can run the following commands: remove the go.sum file, then run 'go mod tidy' and 'go mod verify' to revalidate all dependencies. Until an official fix is available, avoid using untrusted module proxies or checksum databases. Monitor the official Go project advisories for updates and apply patches promptly when released.