PkgSeer

Vulnerability GHSA-5cgq-3rg8-m6cv

Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 months ago
June 25, 2026 at 10:22 PM UTC
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
v0.1.0 - v0.51.0
v0.1.0 - v0.51.0

Summary

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6354
v0.1.0 - v0.55.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6355
v0.1.0 - v0.55.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
v0.1.0 - v0.54.0 GO-2026-6303
v0.1.0 - v0.54.0 GO-2026-6303
Unknown
3 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
v0.1.0 - v0.58.0 GO-2026-5932
v0.1.0 - v0.58.0 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 months ago
June 25, 2026 at 10:22 PM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC