verifying module: checksum mismatch / SECURITY ERROR Go Origin: Application & API Last updated 4 Nov 2026

Go: verifying module: checksum mismatch — SECURITY ERROR This download does NOT match an earlier download recorded in go.sum

A module's content hash differs from the one recorded in go.sum (or the public checksum database).

Exact message you may see verifying module: checksum mismatchSECURITY ERROR This download does NOT match an earlier download recorded in go.sumchecksum mismatch downloaded: h1: go.sum: h1:This download does NOT match an earlier downloadverifying go.mod: checksum mismatch
Explore the map of this error Full error map →
Seen on: Go

Meaning

Do not ignore it. Common benign causes: a tag was force-moved/rewritten by the maintainer, a corrupted cache, or a stale local go.sum. Investigate before accepting: compare against the sumdb, clear the cache (go clean -modcache), then regenerate the entry only if you trust the new content.

Common causes

  • Upstream retagged a version (force push)
  • Corrupt module cache
  • go.sum edited or merged incorrectly
  • Proxy returning different content
  • Genuine tampering (rare, but why the check exists)

⚡ Quick fix

  1. Run go clean -modcache and retry
  2. Compare with GOSUMDB (sum.golang.org) and the upstream tag
  3. Remove the go.sum line and run go mod tidy only after verifying the source

Detailed fix by platform

Go

  1. go clean -modcache && go mod download then go mod verify

How to diagnose

  1. Module — Which version?
  2. Tag — Rewritten upstream?
  3. Cache — Cleared?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

avc: denied — SELinux is preventing ... / avc: denied { read } for pid=... (permission denied despite correct permissions) (Linux)avc: deniedcannot find package in any of GOROOT / GOPATH — Go: cannot find package "github.com/pkg/errors" in any of: /usr/local/go/src/github.com/pkg/errors (from $GOROOT) /go/src/github.com/pkg/errors (from $GOPATH) (Go)cannot find package i…go: updates to go.mod needed — Go: go: updates to go.mod needed; to update it: go mod tidy (Go)go: updates to go.mod…invalid version: unknown revision — Go: go: github.com/foo/bar@v1.2.3: invalid version: unknown revision v1.2.3 (Go)invalid version: unkn…listen tcp :8080: bind: address already in use — Go: listen tcp :8080: bind: address already in use (Go)listen tcp :8080: bin…missing go.sum entry — Go: missing go.sum entry for module providing package github.com/pkg/errors (imported by app); to add: go get app (Go)missing go.sum entryno required module provides package — Go: no required module provides package github.com/foo/bar; to add it: go get github.com/foo/bar (Go)no required module pr…NO_PUBKEY — The following signatures couldn't be verified because the public key is not available: NO_PUBKEY (Linux)NO_PUBKEYverifying…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.