~ / search / GHSA-f5wc-c3c7-36mc

GHSA-f5wc-c3c7-36mc

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-39832

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/crypto < 0.52.0 0.52.0

Details

As written in the advisory (Markdown source, shown as plain text).

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

References

External links from the advisory. They lead to third-party sites.