CVE-2026-94444 | BDVDB-2026-384621 Detail

Description#

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-08Record published in the CVE List.
2. Version 22026-10-15Most recent update recorded in the CVE List.