GHSA-5cgq-3rg8-m6cv CVE-2026-42508 GO-2026-5021

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Critical Go

Severity: 9.1 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 6.91%; Chance of exploitation in the next 30 days. Higher than 94.09% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-295 Improper Certificate Validation
Fix: 0.52.0; Upgrade golang.org/x/crypto to this version or later

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Affected versions

Go

Package	Vulnerable	Fixed in
golang.org/x/crypto	`< 0.52.0`	`0.52.0`
golang.org/x/crypto	`< 0.52.0`	`0.52.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

golang.org/x/crypto Go → `0.52.0`

go

go get golang.org/x/crypto@v0.52.0 && go mod tidy

Severity breakdown

CVSS 3.1 9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

How to prevent it

Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

References

Advisories

Packages

cs.opensource.google/go/x/crypto

Timeline

May 22, 2026 Published
Sep 15, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	Not rated yet	Also affects golang.org/x/crypto
GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	Critical	Also affects golang.org/x/crypto
GHSA-w879-237q-wc7r golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	High	Also affects golang.org/x/crypto
GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	Critical	Also affects golang.org/x/crypto
GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes	Critical	Also affects golang.org/x/crypto

Credits: Omar Khaleel Ibrahim - mr3okk

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor