CVE-2026-42501

A flaw was found in the Go command (cmd/go). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment.

This Moderate impact flaw in the Go command (cmd/go) allows a malicious module proxy to bypass checksum validation, potentially leading to the execution of untrusted Go toolchains. Red Hat products utilizing the Go command are vulnerable if configured to use an untrusted module proxy or checksum database, as this could compromise the integrity of the Go development environment. Exploitation requires user interaction with a compromised proxy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To verify the integrity of Go module dependencies and detect potential tampering by a malicious proxy, users can revalidate all dependencies of the current module. This process involves removing the existing go.sum file and then re-generating and verifying module checksums.

Execute the following commands in your module's root directory:

rm go.sum
go mod tidy
go mod verify

This operation will re-download and re-verify all module dependencies. Be aware that this may affect your local module cache and could require re-building projects.