CVE-2026-56864
CVE
Low
False Positivex/mod/sumdb: Module Content Injection via Colluding GOPROXY and GOSUMDB
This advisory does not affect KrakenD
golang.org/x/mod/sumdb is only exercised by the go command when resolving module
dependencies against a checksum database, a build-time operation. KrakenD’s runtime
binary does not fetch, verify, or resolve Go modules, so it never calls into the
vulnerable GOSUMDB client code.Component
Go extended library (x/mod/sumdb)
Disclosed
Aug 14, 2026
Description
A malicious GOSUMDB could serve arbitrary module content that was never recorded in
the transparency log, and a coordinating GOPROXY could then deliver that unverifiable
content to a Go client. Because the checksum database and the transparency log are
both under attacker control in this scenario, evaluating the log alone cannot detect
the substitution. The issue is fixed in
golang.org/x/mod/sumdb.
This does not affect KrakenD, which never queries a GOSUMDB or GOPROXY at runtime.