GO-2026-5018

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5018

Import Source

https://vuln.go.dev/ID/GO-2026-5018.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5018

Aliases

CVE-2026-39829

Published

2026-05-22T02:08:34Z

Modified

2026-05-22T02:30:16.944054002Z

Summary

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Details

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5018"
}

References

Credits

- NCC Group Cryptography Services, sponsored by Teleport

Affected packages

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.52.0

Ecosystem specific

{
    "imports": [
        {
            "path": "golang.org/x/crypto/ssh",
            "symbols": [
                "Dial",
                "NewClientConn",
                "NewServerConn",
                "NewSignerFromKey",
                "ParseAuthorizedKey",
                "ParseKnownHosts",
                "ParsePrivateKey",
                "ParsePrivateKeyWithPassphrase",
                "ParsePublicKey",
                "ParseRawPrivateKey",
                "ParseRawPrivateKeyWithPassphrase",
                "checkDSAParams",
                "parseDSA",
                "parseRSA"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5018.json"