Fluid Attacks Database

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26.1-1 \|\| =1.26.2-1 \|\| =1.26.2-2 \|\| =1.26.2-3 \|\| =1.26.3-1 \|\| =1.26.3-1~bpo13+1 \|\| =1.26.3-2 \|\| =1.26.3-2~bpo13+1 \|\| =1.26.4-1 \|\| =1.26.4-1~bpo13+1 \|\| =1.26.5-1 \|\| =1.26.5-1~bpo13+1 \|\| =1.26.6-1 \|\| =1.26.6-2 \|\| =1.26.7-1 \|\| =1.26.7-1~bpo13+1 \|\| =1.26.8-1 \|\| =1.26.8-1~bpo13+1 \|\| =1.26.8-2 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.9-1	1.26.9-1
go	toolchain	>=0 <1.26.9	1.26.9
rpm rhel9	golang	-	-
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
debian 13	golang-1.24	=1.24.12-1 \|\| =1.24.13-1 \|\| =1.24.13-2 \|\| =1.24.4-1 \|\| =1.24.4-2 \|\| =1.24.4-3 \|\| =1.24.4-4 \|\| =1.24.7-1 \|\| =1.24.8-1 \|\| =1.24.9-1	-
debian 14	golang-1.27	=1.27.0-1 \|\| =1.27.0-1~bpo13+1 \|\| =1.27.1-1 \|\| =1.27.1-2 \|\| =1.27.1-2~bpo13+1 \|\| =1.27.2-1~bpo13+1 \|\| =1.27~rc1-1 \|\| =1.27~rc2-1 \|\| =1.27~rc3-1 \|\| >=0 <1.27.2-1	1.27.2-1
rpm rhel10	golang	-	-
rpm rhel8	golang	-	-
rpm rhel10	go-toolset	-	-
rpm rhel8	go-toolset	-	-

1-10 of 11

Aliases

1. CVE-2026-944442. NVD-2026-944443. OSV-DEBIAN-2026-944444. OSV-2026-944445. OSV-GO-2026-66016. GCVE-2026-944447. SECURITY-TRACKER-CVE-2026-94444

References

1. https://go.dev/cl/8406852. https://go.dev/issue/818333. https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.