Based on the description, it is inferred that a malicious GOSUMDB can deliver arbitrary module content that is not recorded in the transparency log. This vulnerability allows attackers to serve malicious modules to a client without triggering integrity checks. If exploited, an attacker could introduce tampered or rogue code into a build, leading to potential confidential data leakage or execution of unintended logic. The weakness involves failure to verify the provenance of module artifacts, a classic integrity violation.

Based on the description, it is inferred that the vulnerability affects the Go toolchain commands (cmd/go) and the golang.org/x/mod sumdb package. Specific vendor and product names are: Go toolchain and golang.org/x/mod sumdb. No version range is provided by the CVE, so any version of these components may be at risk until a patch is made available.

Based on the description, it is inferred that the attack requires an attacker who can control a GOSUMDB and a GOPROXY combination served to a client. The CVSS score is 7.5, indicating a high severity, and the EPSS score is < 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. However, if the client relies on a malicious or compromised proxy, module verification can be bypassed. Because the vulnerability leads to the delivery of untrusted code, the risk to confidentiality, integrity, and potentially availability is high for environments that trust third‑party module proxies.