golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

CRÍTICO 9.1CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv · GO-2026-5021 · Published 22/05/2026 · updated 15/09/2026

En resumen

CVE-2026-42508 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a golang.org/x/crypto, crypto (golang).
Probabilidad de explotación en los próximos 30 días (EPSS): 6.9%, mayor que el 94.1% de las vulnerabilidades.
Solución: actualizar a 0.52.0 o posterior.

Package	Affected versions	Patched versions
golang.org/x/crypto Go	`< 0.52.0`	`0.52.0`
crypto golang	`< 0.52.0`	`0.52.0`

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

NVD description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

References

Más vulnerabilidades de golang.org/x/crypto

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free