GitHub Advisoryadvisory · Go

GHSA-jppx-rxg9-jmrx golang.org/x/crypto doesn't enforce invoking key constraints

CRITICAL Published 2026-06-25 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-39833
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862
Reviewed
2026-06-25

Affected packages

• Go golang.org/x/crypto: < 0.52.0 → fixed in 0.52.0

Description

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Related

Alias · CVE (1)

  • CVE-2026-39833 The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References