~ / search / GHSA-9m57-25v3-79x9

GHSA-9m57-25v3-79x9

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-46598

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/crypto < 0.52.0 0.52.0

Details

As written in the advisory (Markdown source, shown as plain text).

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

References

External links from the advisory. They lead to third-party sites.