VDB
CVE-2026-94444
CVE-2026-94444
PUBLISHED
CVSS 7.8 HIGH
Reported by Go · Published October 8, 2026
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Risk Scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0, 1.27.0-0 |
| chainguard | nvidia-nsight-compute-13.3 | 0 |
| amazon:2 | golang-misc | 0 |
| chainguard | nvidia-nsight-compute-12.8 | 0 |
| chainguard | calico-fips-3.30 | * |
| chainguard | gitlab-rails-ce-18.9 | * |
| chainguard | go-slim-1.25 | * |
| amazon:2023 | golang-tests | 0 |
| amazon:2 | golang-src | 0 |
| chainguard | go-msft-1.25 | * |
| chainguard | go-fips-1.25 | * |
| wolfi | go-1.25 | * |
| chainguard | go-openssl-1.25 | * |
| wolfi | calico-3.31 | * |
| chainguard | gitlab-rails-ce-19.1 | * |
| chainguard | go-fips-md5-1.25 | * |
| chainguard | commercial-nginx-ingress | 0 |
| amazon:2 | golang-tests | 0 |
| chainguard | scanner-test-golang-vulnerability-fixed | * |
| amazon:2023 | golang-docs | 0 |
…and 37 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch
- Oct 28, 2026 Distribution Patch
- Oct 29, 2026 Distribution Patch
- Oct 29, 2026 Security Advisory