GHSA-f5wc-c3c7-36mc

Source

https://github.com/advisories/GHSA-f5wc-c3c7-36mc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f5wc-c3c7-36mc/GHSA-f5wc-c3c7-36mc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f5wc-c3c7-36mc

Aliases

Downstream

CGA (4458)

MINI (240)

Published

2026-06-25T22:14:00Z

Modified

2026-09-10T03:50:49Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Details

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Database specific

{
    "cwe_ids":  [
        "CWE-281",
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-25T22:14:00Z",
    "nvd_published_at":  "2026-05-22T04:16:22Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.52.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f5wc-c3c7-36mc/GHSA-f5wc-c3c7-36mc.json"