CVE-2026-94444
Checksum bypass for golang.org/fips140 in cmd/go
Published Oct 8, 2026 · updated Oct 10, 2026
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Timeline
Detection, updates, and resolution for this record.
Oct 8, 2026 · Catalog
Detected
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Oct 10, 2026 · Catalog
Fix available
Go toolchain 0 → 1.26.9
Oct 10, 2026 · Catalog
Updated
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Affected
- Go toolchain0 → 1.26.9