GO-2026-5932
- Source
- https://pkg.go.dev/vuln/GO-2026-5932
- Import Source
- https://vuln.go.dev/ID/GO-2026-5932.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5932
- Downstream
- Related
- Published
- 2026-07-07T22:15:29Z
- Modified
- 2026-07-10T05:44:31.101996029Z
- Summary
- The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
- Details
-
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
- Database specific
{ "url": "https://pkg.go.dev/vuln/GO-2026-5932", "review_status": "REVIEWED" }- References
Affected packages
Go / golang.org/x/crypto
Package
- Name
- golang.org/x/crypto
- View open source insights on deps.dev
- Purl
- pkg:golang/golang.org/x/crypto
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Ecosystem specific
{
"imports": [
{
"path": "golang.org/x/crypto/openpgp"
},
{
"path": "golang.org/x/crypto/openpgp/packet"
},
{
"path": "golang.org/x/crypto/openpgp/armor"
},
{
"path": "golang.org/x/crypto/openpgp/clearsign"
},
{
"path": "golang.org/x/crypto/openpgp/errors"
},
{
"path": "golang.org/x/crypto/openpgp/elgamal"
},
{
"path": "golang.org/x/crypto/openpgp/s2k"
}
]
}