Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 08 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain. | |
| Title | Checksum bypass for golang.org/fips140 in cmd/go | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-10-08T22:53:57.787Z
Reserved: 2026-09-21T16:43:04.757Z
Link: CVE-2026-94444
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-08T23:17:05.050
Modified: 2026-10-08T23:17:05.050
Link: CVE-2026-94444
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.