cmd/go: malicious GOMODPROXY can cause golang.org/fips140 checksum bypass
Author: thatnealpatelCreated Sep 28, 2026Updated Sep 28, 2026
LabelsSecurityrelease-blocker
A series of esoteric user actions and a maliciously acting GOMODPROXY can cause a crafted golang.org/fips140 module to be accepted by the toolchain without correctly verifying its trusted, bundled checksum.
This is CVE-2026-94444, originally tracked as http://b/552479602.
Source: golang/go