Skip to content
Log inStart free trial

GHSA-45gg-vh54-h5m9 CVE-2026-39828 GO-2026-5014

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Medium Go
Severity
6.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.37%
Chance of exploitation in the next 30 days. Higher than 30.80% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-281 Improper Preservation of Permissions
CWE-295 Improper Certificate Validation
Fix
0.52.0
Upgrade golang.org/x/crypto to this version or later

Description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Affected versions

Go

PackageVulnerableFixed in
golang.org/x/crypto
< 0.52.0
0.52.0
golang.org/x/crypto
< 0.52.0
0.52.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

golang.org/x/crypto Go → 0.52.0

go
go get golang.org/x/crypto@v0.52.0 && go mod tidy

Severity breakdown

CVSS 3.1 6.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Weakness

CWE-281: Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

How to prevent it
  • Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
  • Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GO-2026-6355
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
High Also affects golang.org/x/crypto
GO-2026-6354
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
High Also affects golang.org/x/crypto
GO-2026-6303
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
High Also affects golang.org/x/crypto
GO-2026-5932
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
Not rated yet Also affects golang.org/x/crypto
GHSA-x527-x647-q7gg
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Critical Also affects golang.org/x/crypto
GHSA-w879-237q-wc7r
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
High Also affects golang.org/x/crypto
GHSA-vgwf-h737-ff37
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Critical Also affects golang.org/x/crypto
GHSA-rm3j-f69w-wqmq
golang.org/x/crypto vulnerable to infinite loop on large channel writes
Critical Also affects golang.org/x/crypto

Credits: NCC Group Cryptography Services, sponsored by Teleport

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor