CVE-2026-56865 (High) detected in golang.org/x/mod-v0.33.0

[mend-bolt-for-github]

CVE-2026-56865 - High Severity Vulnerability

Vulnerable Library - golang.org/x/mod-v0.33.0

Library home page: https://proxy.golang.org/golang.org/x/mod/@⁠v/v0.33.0.zip

Sample Path to Dependency File: /engine/go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/mod/@⁠v/v0.33.0.mod

Dependency Hierarchy:

• ❌ golang.org/x/mod-v0.33.0 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Publish Date: 2026-08-13

URL: CVE-2026-56865

CVSS 3 Score Details (8.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-13

Fix Resolution: https://github.com/golang/mod.git - v0.40.0,golang.org/x/mod - v0.40.0

---

Step up your Open Source Security Game with Mend here

[NikolayS]

Maintainer triage (2026-08-18): current master is already on golang.org/x/mod v0.35.0, while this issue was opened against v0.33.0. The advisory still requires v0.40.0, so the current dependency remains below the fixed version.

Runtime reachability appears low: DBLab imports only golang.org/x/mod/semver in the WAL-G and PostgreSQL extension version checks; it does not import the affected sumdb/module-fetch packages into the engine path. This is therefore primarily a dependency/build-integrity remediation for this repository, not evidence of an exposed DBLab runtime endpoint.

Action: bump golang.org/x/mod to v0.40.0 (with the coordinated golang.org/x dependency updates required by MVS), regenerate go.sum from a trusted proxy/sumdb path, and run the full engine test/build matrix. Keep this issue open until that lands.