PkgSeer

Vulnerability GHSA-x527-x647-q7gg

Critical
CRITICAL RISK
CVSS Score: 10.0
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 months ago
June 25, 2026 at 10:23 PM UTC
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
v0.1.0 - v0.51.0
v0.1.0 - v0.51.0

Summary

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Details

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6354
v0.1.0 - v0.55.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6355
v0.1.0 - v0.55.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
v0.1.0 - v0.54.0 GO-2026-6303
v0.1.0 - v0.54.0 GO-2026-6303
Unknown
3 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
v0.1.0 - v0.58.0 GO-2026-5932
v0.1.0 - v0.58.0 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
v0.1.0 - v0.51.0 GHSA-5cgq-3rg8-m6cv
v0.1.0 - v0.51.0 GHSA-5cgq-3rg8-m6cv
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 months ago
June 25, 2026 at 10:23 PM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC