CVE-2026-42501 involves improper verification of cryptographic signatures in the Go toolchain's cmd/go module, specifically allowing a malicious module proxy to bypass checksum database validation. The vulnerability arises because the go command incorrectly accepts empty or unrelated checksum responses as valid, undermining the integrity checks intended to prevent tampering. This can lead to execution of altered Go toolchain versions or modules when users rely on untrusted GOPROXY or GOSUMDB configurations. Although the go tool validates hashes before execution, this does not fully mitigate the risk if the base toolchain itself is compromised. The affected versions include Go toolchain versions up to 1.26.0-0. Currently, no official patch or remediation level has been provided by the vendor.

The vulnerability allows attackers controlling a malicious module proxy to bypass checksum validation, potentially causing execution of tampered Go toolchain versions or modules. This can lead to compromise of the build environment, affecting confidentiality, integrity, and availability of software built with the affected Go toolchain versions. The impact is rated high due to the potential for arbitrary code execution and supply chain compromise. No known exploits are reported in the wild at this time.

No official patch or remediation is currently available. Users should monitor vendor advisories for an official fix and plan to upgrade the Go toolchain once a patch is released. In the meantime, users should avoid using untrusted GOPROXY or GOSUMDB configurations. Potential compromise can be detected by regenerating and verifying go.sum files. No other vendor-provided mitigations are currently documented.