CVE-2026-94444

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

References

https://pkg.go.dev/vuln/GO-2026-6601

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

https://go.dev/issue/81833

https://go.dev/cl/840685

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95417

Details

Source: Mitre, NVD

Named Vulnerability: GO-2026-6601Named Vulnerability: GHSA-2f4j-3hgj-v9j7

Risk Information

CVSS v2

CVSS v3

EPSS