GO-2026-5932
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
Not rated yet
Go
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| golang.org/x/crypto | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Issue reports
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh | High | Also affects golang.org/x/crypto |
| GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh | High | Also affects golang.org/x/crypto |
| GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh | High | Also affects golang.org/x/crypto |
| GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement | Critical | Also affects golang.org/x/crypto |
| GHSA-w879-237q-wc7r golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS | High | Also affects golang.org/x/crypto |
| GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses | Critical | Also affects golang.org/x/crypto |
| GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes | Critical | Also affects golang.org/x/crypto |
| GHSA-qpw4-5x99-6vjp golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS | Medium | Also affects golang.org/x/crypto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor