x/mod/sumdb: Module Content Injection via Colluding GOPROXY and GOSUMDB

This CVE does not affect KrakenD

golang.org/x/mod/sumdb is only exercised by the go command when resolving module dependencies against a checksum database, a build-time operation. KrakenD’s runtime binary does not fetch, verify, or resolve Go modules, so it never calls into the vulnerable GOSUMDB client code.

Addressed through routine dependency maintenance in CE 2.13.9 and EE 2.13.7.

Component

Go extended library (x/mod/sumdb)

Disclosed

Aug 14, 2026

Description

A malicious GOSUMDB could serve arbitrary module content that was never recorded in the transparency log, and a coordinating GOPROXY could then deliver that unverifiable content to a Go client. Because the checksum database and the transparency log are both under attacker control in this scenario, evaluating the log alone cannot detect the substitution. The issue is fixed in golang.org/x/mod/sumdb. This does not affect KrakenD, which never queries a GOSUMDB or GOPROXY at runtime.

References

View CVE-2026-56864 on NVD

Stay up to date with KrakenD releases and important updates