Go - OSV

GO-2026-6354

Go/golang.org/x/crypto

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh 02 Sep

Fix available

GO-2026-6355

Go/golang.org/x/crypto

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 02 Sep

Fix available

GO-2026-6303

Go/golang.org/x/crypto

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh 28 Aug

Fix available

GO-2026-5932

Go/golang.org/x/crypto

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues 07 Jul

No fix available

GHSA-x527-x647-q7gg

Go/golang.org/x/crypto

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement 25 Jun

Fix available
Severity - 10.0 (Critical)

GHSA-5cgq-3rg8-m6cv

Go/golang.org/x/crypto

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status 25 Jun

Fix available
Severity - 9.1 (Critical)

GHSA-rm3j-f69w-wqmq

Go/golang.org/x/crypto

golang.org/x/crypto vulnerable to infinite loop on large channel writes 25 Jun

Fix available
Severity - 9.1 (Critical)

GHSA-89gr-r52h-f8rx

Go/golang.org/x/crypto

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed 25 Jun

Fix available
Severity - 9.1 (Critical)

GHSA-w879-237q-wc7r

Go/golang.org/x/crypto

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS 25 Jun

Fix available
Severity - 7.5 (High)

GHSA-vgwf-h737-ff37

Go/golang.org/x/crypto

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses 25 Jun

Fix available
Severity - 9.1 (Critical)

GHSA-qpw4-5x99-6vjp

Go/golang.org/x/crypto

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS 25 Jun

Fix available
Severity - 6.5 (Medium)

GHSA-78mq-xcr3-xm33

Go/golang.org/x/crypto

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow 25 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-45gg-vh54-h5m9

Go/golang.org/x/crypto

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions 25 Jun

Fix available
Severity - 6.3 (Medium)

GHSA-q4h4-gmj2-qvw2

Go/golang.org/x/crypto

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic 25 Jun

Fix available
Severity - 7.5 (High)

GHSA-f5wc-c3c7-36mc

Go/golang.org/x/crypto

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys 25 Jun

Fix available
Severity - 9.1 (Critical)

GHSA-jppx-rxg9-jmrx

Go/golang.org/x/crypto

golang.org/x/crypto doesn't enforce invoking key constraints 25 Jun

Fix available
Severity - 9.1 (Critical)

Vulnerabilities