En bref
- CVE-2026-39832 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant golang.org/x/crypto, crypto (golang).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.68%, plus élevée que 52.5% des vulnérabilités.
- Correctif : mettre à jour vers 0.52.0 ou plus récent.
Description
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
NVD description
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Autres vulnérabilités de golang.org/x/crypto
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free