GHSA-9m57-25v3-79x9

Suggest an improvement
Source
https://github.com/advisories/GHSA-9m57-25v3-79x9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9m57-25v3-79x9/GHSA-9m57-25v3-79x9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9m57-25v3-79x9
Aliases
Downstream
Related
Published
2026-06-25T22:12:52Z
Modified
2026-07-07T15:30:09.937212370Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
Details

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Database specific 
{
    "nvd_published_at": "2026-05-22T04:16:26Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-129"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-25T22:12:52Z"
}
References

Affected packages

Go / golang.org/x/crypto

Package

Name
golang.org/x/crypto
View open source insights on deps.dev
Purl
pkg:golang/golang.org/x/crypto

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.52.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9m57-25v3-79x9/GHSA-9m57-25v3-79x9.json"