Input validation error in Go programming language - CVE-2026-42501
Published: July 31, 2026
Vulnerability identifier: #VU140609
CSH Severity: High
CVSS v4 BT: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2026-42501
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass checksum database validation.
The vulnerability exists due to improper input validation in cmd/go when validating downloaded modules and toolchain downloads through a module proxy or checksum database. A remote attacker can return an empty checksum response or a checksum response for an unrelated module to bypass checksum database validation.
Exploitation requires use of an untrusted module proxy or checksum database, and downloaded toolchains are affected when a different Go toolchain version is selected.
Affected software
Go programming language
How to mitigate CVE-2026-42501
Install security update from vendor's website.
Go programming language - addressed in versions 1.25.10, 1.26.3