chore(deps): update module golang.org/x/crypto to v0.52.0 [security] (main) by renovate[bot] · Pull Request #147 · devopsfactory-io/neptune

renovate · 2026-07-12T18:37:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	`v0.49.0` → `v0.52.0`

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

CVE-2026-39828 / GHSA-45gg-vh54-h5m9 / GO-2026-5014

More information

Details

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

CVE-2026-42508 / GHSA-5cgq-3rg8-m6cv / GO-2026-5021

More information

Details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

CVE-2026-39835 / GHSA-78mq-xcr3-xm33 / GO-2026-5015

More information

Details

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

CVE-2026-39831 / GHSA-89gr-r52h-f8rx / GO-2026-5019

More information

Details

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

CVE-2026-46598 / GHSA-9m57-25v3-79x9 / GO-2026-5033

More information

Details

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

CVE-2026-39832 / GHSA-f5wc-c3c7-36mc / GO-2026-5006

More information

Details

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto doesn't enforce invoking key constraints

CVE-2026-39833 / GHSA-jppx-rxg9-jmrx / GO-2026-5005

More information

Details

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

CVE-2026-46597 / GHSA-q4h4-gmj2-qvw2 / GO-2026-5013

More information

Details

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

CVE-2026-39827 / GHSA-qpw4-5x99-6vjp / GO-2026-5016

More information

Details

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto vulnerable to infinite loop on large channel writes

CVE-2026-39834 / GHSA-rm3j-f69w-wqmq / GO-2026-5020

More information

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

CVE-2026-39830 / GHSA-vgwf-h737-ff37 / GO-2026-5017

More information

Details

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

CVE-2026-39829 / GHSA-w879-237q-wc7r / GO-2026-5018

More information

Details

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

CVE-2026-46595 / GHSA-x527-x647-q7gg / GO-2026-5023

More information

Details

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Severity

CVSS Score: 10.0 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

CVE-2026-39833 / GHSA-jppx-rxg9-jmrx / GO-2026-5005

More information

Details

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

CVE-2026-39832 / GHSA-f5wc-c3c7-36mc / GO-2026-5006

More information

Details

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

CVE-2026-46597 / GHSA-q4h4-gmj2-qvw2 / GO-2026-5013

More information

Details

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

CVE-2026-39828 / GHSA-45gg-vh54-h5m9 / GO-2026-5014

More information

Details

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

CVE-2026-39835 / GHSA-78mq-xcr3-xm33 / GO-2026-5015

More information

Details

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

CVE-2026-39827 / GHSA-qpw4-5x99-6vjp / GO-2026-5016

More information

Details

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

CVE-2026-39830 / GHSA-vgwf-h737-ff37 / GO-2026-5017

More information

Details

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

CVE-2026-39829 / GHSA-w879-237q-wc7r / GO-2026-5018

More information

Details

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

CVE-2026-39831 / GHSA-89gr-r52h-f8rx / GO-2026-5019

More information

Details

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

CVE-2026-39834 / GHSA-rm3j-f69w-wqmq / GO-2026-5020

More information

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

CVE-2026-42508 / GHSA-5cgq-3rg8-m6cv / GO-2026-5021

More information

Details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

CVE-2026-46595 / GHSA-x527-x647-q7gg / GO-2026-5023

More information

Details

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

CVE-2026-46598 / GHSA-9m57-25v3-79x9 / GO-2026-5033

More information

Details

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-12T18:37:19Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

6 additional dependencies were updated

Details:

Package	Change
`golang.org/x/mod`	`v0.33.0` -> `v0.35.0`
`golang.org/x/net`	`v0.52.0` -> `v0.54.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.45.0`
`golang.org/x/term`	`v0.41.0` -> `v0.43.0`
`golang.org/x/text`	`v0.35.0` -> `v0.37.0`
`golang.org/x/tools`	`v0.42.0` -> `v0.44.0`

github-actions · 2026-07-12T18:37:52Z

OpenSSF Scorecard — 7.2/10 ✅

Check	Score	Details
Binary-Artifacts	10/10	no binaries found in the repo
CI-Tests	10/10	29 out of 29 merged PRs checked by a CI test -- score normalized to 10
Code-Review	0/10	Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow	10/10	no dangerous workflow patterns detected
License	10/10	license file detected
Pinned-Dependencies	9/10	dependency not pinned by hash detected -- score normalized to 9
Security-Policy	10/10	security policy file detected
Token-Permissions	10/10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	0/10	13 existing vulnerabilities detected

Threshold: 7 | Full report

github-actions · 2026-07-12T18:39:42Z

🌊 Neptune Plan Results

Terraform Stacks: stack-a, stack-b

Neptune completed the plan with status: ✅

For more details, see the GitHub Actions run

Command ✅ terraform init -input=false (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/null versions matching "~> 3.0"...
- Finding hashicorp/local versions matching "~> 2.0"...
- Installing hashicorp/null v3.3.0...
- Installed hashicorp/null v3.3.0 (signed by HashiCorp)
- Installing hashicorp/local v2.9.0...
- Installed hashicorp/local v2.9.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Command ✅ terraform init -input=false (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/local versions matching "~> 2.0"...
- Finding hashicorp/null versions matching "~> 3.0"...
- Installing hashicorp/local v2.9.0...
- Installed hashicorp/local v2.9.0 (signed by HashiCorp)
- Installing hashicorp/null v3.3.0...
- Installed hashicorp/null v3.3.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Command ✅ terraform plan -input=false -out=tfplan (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.out will be created
  + resource "local_file" "out" {
      + content              = "stack-a output"
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "./out.txt"
      + id                   = (known after apply)
    }

  # null_resource.stack_a will be created
  + resource "null_resource" "stack_a" {
      + id       = (known after apply)
      + triggers = {
          + "stack" = "stack-a"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

Command ✅ terraform plan -input=false -out=tfplan (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.out will be created
  + resource "local_file" "out" {
      + content              = "stack-b output"
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "./out.txt"
      + id                   = (known after apply)
    }

  # null_resource.stack_b will be created
  + resource "null_resource" "stack_b" {
      + id       = (known after apply)
      + triggers = {
          + "stack" = "stack-b"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

To apply these changes, comment:

@neptbot apply

github-actions · 2026-07-12T18:39:46Z

🌊 Neptune Apply Results

Terraform Stacks: stack-a, stack-b

Neptune completed the apply with status: ✅

For more details, see the GitHub Actions run

Command ✅ terraform apply -input=false tfplan (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] null_resource.stack_a: Creating...
null_resource.stack_a: Creation complete after 0s [id=5567941252243287842]
local_file.out: Creating...
local_file.out: Creation complete after 0s [id=a57cdd3e7db0022635e46b54e3ae6357944d9ed4]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Command ✅ terraform apply -input=false tfplan (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] null_resource.stack_b: Creating...
local_file.out: Creating...
null_resource.stack_b: Creation complete after 0s [id=7046067531818814912]
local_file.out: Creation complete after 0s [id=2d8eff4b1ddeb10a7cfb78093bc91edb5b3318f8]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

github-actions · 2026-07-12T18:39:47Z

Lambda integration test executed with success...

client_payload:

PR: chore(deps): update module golang.org/x/crypto to v0.52.0 [security] (main) #147
Branch: renovate/main-go-golang.org-x-crypto-vulnerability
Command: plan
SHA: 35f4996
Repo: devopsfactory-io/neptune

chore(deps): update module golang.org/x/crypto to v0.52.0 [security]

35f4996

renovate Bot added the security label Jul 12, 2026

renovate Bot requested a review from kaio6fellipe as a code owner July 12, 2026 18:37

renovate Bot added the security label Jul 12, 2026

github-actions Bot added neptune dependencies labels Jul 12, 2026

neptune-ci-tests Bot mentioned this pull request Jul 12, 2026

CI: Neptune PR #147 integration test devopsfactory-io/neptune-tests#162

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update module golang.org/x/crypto to v0.52.0 [security] (main)#147

chore(deps): update module golang.org/x/crypto to v0.52.0 [security] (main)#147
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-go-golang.org-x-crypto-vulnerability

renovate Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Details

Severity

References

golang.org/x/crypto vulnerable to auth bypass via unenforced @​revoked status

Details

Severity

References

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

Details

Severity

References

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

Details

Severity

References

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Details

Severity

References

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Details

Severity

References

golang.org/x/crypto doesn't enforce invoking key constraints

Details

Severity

References

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

Details

Severity

References

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Details

Severity

References

golang.org/x/crypto vulnerable to infinite loop on large channel writes

Details

Severity

References

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

Details

Severity

References

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

Details

Severity

References

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Details

Severity

References

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

Details

Severity

References

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Details

Severity

References

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Details

Severity

References

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Details

Severity

References

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Details

Severity

References

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

Details

Severity

References

renovate Bot commented Jul 12, 2026 •

edited

Loading

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts