—
GO-2026-6180
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Quick fix
GO-2026-6180 — toolchain: upgrade to the fixed version with the command below.
go get toolchain@v1.25.13Details
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.
This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Are you affected?
Enter the version of the package you're using.