Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

golang.org/x/crypto — Vulnerabilities & Security Advisories 19

Browse all 19 CVE security advisories affecting golang.org/x/crypto. AI-powered Chinese analysis, POCs, and references for each vulnerability.

golang.org/x/crypto provides essential cryptographic implementations for Go applications, including encryption, hashing, and secure communication protocols. Historically, vulnerabilities have primarily centered on memory safety issues, logic flaws in cryptographic operations, and incorrect input validation, leading to potential RCE or information disclosure. While no major public incidents have been widely documented, the 6 CVEs on record highlight ongoing risks in areas like key handling and protocol implementation. The project maintains active security practices, with regular updates addressing potential flaws in its diverse cryptographic suite, which is critical for securing Go-based systems across various domains.

CVE ID Title CVSS Severity Published
CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent — golang.org/x/crypto/ssh/agent - - 2026-05-22
CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts — golang.org/x/crypto/ssh/knownhosts - - 2026-05-22
CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent — golang.org/x/crypto/ssh/agent - - 2026-05-22
CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh - - 2026-05-22
CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent — golang.org/x/crypto/ssh/agent - - 2026-05-22
CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent — golang.org/x/crypto/ssh/agent 7.5AI High AI 2025-11-19
CVE-2025-58181 Unbounded memory consumption in golang.org/x/crypto/ssh — golang.org/x/crypto/ssh 7.5AI High AI 2025-11-19
CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent — golang.org/x/crypto/ssh/agent 7.5 - 2025-11-13
CVE-2025-22869 Potential denial of service in golang.org/x/crypto — golang.org/x/crypto/ssh 7.5 - 2025-02-26
CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto — golang.org/x/crypto/ssh 9.8 - 2024-12-11
CVE-2022-30636 Limited directory traversal vulnerability on Windows in golang.org/x/crypto — golang.org/x/crypto/acme/autocert 8.1AI High AI 2024-07-02

This page lists every published CVE security advisory associated with golang.org/x/crypto. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.