Go patched two critical sumdb vulnerabilities overnight. golang/mod's TileHashReader had an authentication bypass (CVE-2024-34156). Lookup was accepting unrelated tile hashes without validation, letting attackers inject forged module metadata. Fix is in the latest x/mod. ASN1 decoder now enforces max recursion depth to block deeply-nested structures from DoS. Scope's tight but the attack surface was real. Vendored x/mod refreshed across golang/go, pkgsite, and tools. vulndb added release reports for 1.25.13, 1.26.6, and 1.27rc3. If you're pinning Go modules, pull the latest x/mod. If you're running pkgsite, refresh your dependencies. #golang https://repojournal.com/showcase/golang/2026-08-14/go-patches-two-critical-sumdb-vulnerabilities-overnight
Post summary
Go updated and patched two critical sumdb vulnerabilities (notably CVE‑2024‑34156) with new releases and advisory guidance.