~ / search / GHSA-5cgq-3rg8-m6cv

GHSA-5cgq-3rg8-m6cv

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-42508

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/crypto < 0.52.0 0.52.0

Details

As written in the advisory (Markdown source, shown as plain text).

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

References

External links from the advisory. They lead to third-party sites.