GitHub Advisoryadvisory · Go

GHSA-5cgq-3rg8-m6cv golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

CRITICAL Published 2026-06-25 Modified 2026-07-17 Official page ↗
Aliases
CVE-2026-42508
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-06-25

Affected packages

• Go golang.org/x/crypto: < 0.52.0 → fixed in 0.52.0

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Related

Alias · CVE (1)

  • CVE-2026-42508 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References