Repository navigation
[vuln-sentinel] CRITICAL Go golang.org/x/crypto: 30 known vulnerabilities #4
Description
Package: golang.org/x/crypto (Go)
Upgrade to: v0.58.1-0.20261009181718-2f1f834330b2 or later
Found in: implementations/04-web3-sbt-contacts/backend-relayer/go.mod
| Vulnerability | Severity | Installed | Fixed in | Summary | |
|---|---|---|---|---|---|
| GHSA-5cgq-3rg8-m6cv | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status | |
| GHSA-89gr-r52h-f8rx | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed | |
| GHSA-f5wc-c3c7-36mc | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys | |
| GHSA-jppx-rxg9-jmrx | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto doesn't enforce invoking key constraints | |
| GHSA-rm3j-f69w-wqmq | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto vulnerable to infinite loop on large channel writes | |
| GHSA-vgwf-h737-ff37 | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses | |
| GHSA-x527-x647-q7gg | CRITICAL | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement | |
| GHSA-q4h4-gmj2-qvw2 | HIGH | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic | |
| GHSA-w879-237q-wc7r | HIGH | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS | |
| GHSA-45gg-vh54-h5m9 | MEDIUM | v0.50.0 | v0.52.0 | golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions | |
| GHSA-78mq-xcr3-xm33 | MEDIUM | v0.50.0 | v0.52.0 | golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow | |
| GHSA-9m57-25v3-79x9 | MEDIUM | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking pathological inputs can lead to client panic | |
| GHSA-qpw4-5x99-6vjp | MEDIUM | v0.50.0 | v0.52.0 | golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS | |
| GO-2026-5005 | ? | v0.50.0 | v0.52.0 | Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent | |
| GO-2026-5006 | ? | v0.50.0 | v0.52.0 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent | |
| GO-2026-5013 | ? | v0.50.0 | v0.52.0 | Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh | |
| GO-2026-5014 | ? | v0.50.0 | v0.52.0 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh | |
| GO-2026-5015 | ? | v0.50.0 | v0.52.0 | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh | |
| GO-2026-5016 | ? | v0.50.0 | v0.52.0 | Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh | |
| GO-2026-5017 | ? | v0.50.0 | v0.52.0 | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh | |
| GO-2026-5018 | ? | v0.50.0 | v0.52.0 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh | |
| GO-2026-5019 | ? | v0.50.0 | v0.52.0 | Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh | |
| GO-2026-5020 | ? | v0.50.0 | v0.52.0 | Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh | |
| GO-2026-5021 | ? | v0.50.0 | v0.52.0 | Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts | |
| GO-2026-5023 | ? | v0.50.0 | v0.52.0 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | |
| GO-2026-5033 | ? | v0.50.0 | v0.52.0 | Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent | |
| GO-2026-5932 | ? | v0.50.0 | v0.58.1-0.20261009181718-2f1f834330b2 | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues | |
| GO-2026-6303 | ? | v0.50.0 | v0.55.0 | Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh | |
| GO-2026-6354 | ? | v0.50.0 | v0.56.0 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh | |
| GO-2026-6355 | ? | v0.50.0 | v0.56.0 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh |
Fix PR: #3
Daily report: https://github.com/BabyGrootCICD/cve_validator_patcher/blob/main/reports/2026-10-28.md
Managed by vuln-sentinel. This issue closes automatically once the vulnerable versions are gone from the default branch.
Activity