--- id: CVE-2026-42501 title: >- cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) summary: >- A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` com… severity: medium cvss: 5.3 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N' cvssSource: vendor cwe: CWE-347 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - exploit_intelligence - multicluster_engine_for_kubernetes - openshift_api_for_data_protection - openshift_service_mesh 2 - openshift_service_mesh 3 - advanced_cluster_management_for_kubernetes 2 - enterprise_linux_ai_rhel_ai 3 - openshift_container_platform 4 - openshift_virtualization 4 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - hardened_images patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - hardened_images published: '2026-05-07' updated: '2026-09-09' sourceUpdated: '2026-09-09T00:37:19+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42501.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42501.json - url: 'https://access.redhat.com/security/cve/CVE-2026-42501' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2467810' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42501' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42501' - url: 'https://go.dev/cl/775321' - url: 'https://go.dev/issue/79070' - url: 'https://groups.google.com/g/golang-announce/c/qcCIEXso47M' - url: 'https://pkg.go.dev/vuln/GO-2026-4984' - url: 'https://access.redhat.com/errata/RHSA-2026:49702' - url: 'https://access.redhat.com/errata/RHSA-2026:22120' - url: 'https://access.redhat.com/errata/RHSA-2026:22112' - url: 'https://access.redhat.com/errata/RHSA-2026:61253' - url: 'https://access.redhat.com/errata/RHSA-2026:57649' - url: 'https://access.redhat.com/errata/RHSA-2026:49712' - url: 'https://access.redhat.com/errata/RHSA-2026:22121' - url: 'https://access.redhat.com/errata/RHSA-2026:32987' - url: 'https://access.redhat.com/errata/RHSA-2026:23262' - url: 'https://access.redhat.com/errata/RHSA-2026:23264' tags: - csaf - vex - red-hat - osv - go epss: 0.00285 epssPercentile: 0.1864 aliases: - GO-2026-4984 - BIT-golang-2026-42501 ecosystem: go ingestedAt: '2026-08-26T19:27:02.550Z' --- ## Overview A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment. ## Vendor advisories - **RHSA-2026:49702** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49702) - **RHSA-2026:22120** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22120) - **RHSA-2026:22112** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22112) - **RHSA-2026:61253** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61253) - **RHSA-2026:57649** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57649) - **RHSA-2026:49712** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49712) - **RHSA-2026:22121** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22121) - **RHSA-2026:32987** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:32987) - **RHSA-2026:23262** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23262) - **RHSA-2026:23264** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23264) - **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Multicluster Engine for Kubernetes, OpenShift API for Data Protection, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: Exploit Intelligence, Multicluster Engine for Kubernetes, OpenShift API for Data Protection, OpenShift Service Mesh 2, … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42501.json) **cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy** — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-09-09. Affected: - Exploit Intelligence - Multicluster Engine for Kubernetes - OpenShift API for Data Protection - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 4 Fixed: - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream E4S (v.9.2) - Red Hat Enterprise Linux AppStream E4S (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Hardened Images No fix planned: - Exploit Intelligence - Multicluster Engine for Kubernetes - OpenShift API for Data Protection - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 4 - Red Hat Advanced Cluster Management for Kubernetes 2 Not affected: - Multicluster Engine for Kubernetes - Red Hat Advanced Cluster Management for Kubernetes 2 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:49702 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112 Workarounds / mitigations: - To verify the integrity of Go module dependencies and detect potential tampering by a malicious proxy, users can revalidate all dependencies of the current module. This process involves removing the existing `go.sum` file and then re-generating and verifying module checksums. Execute the following commands in your module's root directory: ```bash rm go.sum go mod tidy go mod verify ``` This operation will re-download and re-verify all module dependencies. Be aware that this may affect your loc… ## Package advisory (CVE-2026-42501) Affected packages: - `toolchain >= 1.26.0-0, < 1.26.3` Patched in: - `toolchain 1.26.3` Source: https://osv.dev/vulnerability/GO-2026-4984