GHSA-vgwf-h737-ff37 critical
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
golang.org/x/crypto
Go package metadata, published advisories, affected versions, and known-exploitation evidence.
Go latest v0.57.0
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
v0.57.0
Published advisories match this version
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
32 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-v778-237x-gjrc critical
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
Affected range
SEMVER: introduced 0; fixed 0.31.0Fixed versions: 0.31.0
GHSA-x527-x647-q7gg critical
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-rm3j-f69w-wqmq critical
golang.org/x/crypto vulnerable to infinite loop on large channel writes
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-jppx-rxg9-jmrx critical
golang.org/x/crypto doesn't enforce invoking key constraints
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-f5wc-c3c7-36mc critical
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-89gr-r52h-f8rx critical
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-5cgq-3rg8-m6cv critical
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-w879-237q-wc7r high
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-q4h4-gmj2-qvw2 high
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-hcg3-q754-cr77 high
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
Affected range
SEMVER: introduced 0; fixed 0.35.0Fixed versions: 0.35.0
GHSA-gwc9-m7rh-j2ww high
x/crypto/ssh vulnerable to panic via malformed packets
Affected range
SEMVER: introduced 0; fixed 0.0.0-20211202192323-5770296d904eFixed versions: 0.0.0-20211202192323-5770296d904e
GHSA-3vm4-22fp-5rfm high
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
Affected range
SEMVER: introduced 0; fixed 0.0.0-20201216223049-8b5274cf687fFixed versions: 0.0.0-20201216223049-8b5274cf687f
GHSA-8c26-wmh5-6g9v high
golang.org/x/crypto/ssh Denial of service via crafted Signer
Affected range
SEMVER: introduced 0; fixed 0.0.0-20220314234659-1baeb1ce4c0bFixed versions: 0.0.0-20220314234659-1baeb1ce4c0b
GHSA-ffhg-7mh4-33c4 high
Improper Verification of Cryptographic Signature in golang.org/x/crypto
Affected range
SEMVER: introduced 0; fixed 0.0.0-20200220183623-bac4c82f6975Fixed versions: 0.0.0-20200220183623-bac4c82f6975
GHSA-cjjc-xp8v-855w high
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Affected range
SEMVER: introduced 0; fixed 0.0.0-20200124225646-8b5121be2f68Fixed versions: 0.0.0-20200124225646-8b5121be2f68
GHSA-xhjq-w7xm-p8qj high
golang.org/x/crypto/ssh Man-in-the-Middle attack
Affected range
SEMVER: introduced 0; fixed 0.0.0-20170330155735-e4e2799dd7aaFixed versions: 0.0.0-20170330155735-e4e2799dd7aa
GHSA-78mq-xcr3-xm33 moderate
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-45gg-vh54-h5m9 moderate
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-9m57-25v3-79x9 moderate
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-qpw4-5x99-6vjp moderate
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
Affected range
SEMVER: introduced 0; fixed 0.52.0Fixed versions: 0.52.0
GHSA-j5w8-q4qc-rx2x moderate
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
Affected range
SEMVER: introduced 0; fixed 0.45.0Fixed versions: 0.45.0
GHSA-f6x5-jh6r-wrfv moderate
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
Affected range
SEMVER: introduced 0; fixed 0.45.0Fixed versions: 0.45.0
GHSA-45x7-px36-x8w8 moderate
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
Affected range
SEMVER: introduced 0.1.0; fixed 0.17.0SEMVER: introduced 0; fixed 0.0.0-20231218163308-9d2ee975ef9fSEMVER: introduced 0; fixed 0.17.0Fixed versions: 0.17.0, 0.0.0-20231218163308-9d2ee975ef9f
GHSA-x3jr-pf6g-c48f moderate
Golang/x/crypto message forgery vulnerability
Affected range
SEMVER: introduced 0; fixed 0.0.0-20190424203555-c05e17bb3b2dFixed versions: 0.0.0-20190424203555-c05e17bb3b2d
Show 7 more advisories
GHSA-r5c5-pr8j-pfp7 golang.org/x/crypto/salsa20/salsa uses insufficiently random values
GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2024-2961 Limited directory traversal vulnerability on Windows in golang.org/x/crypto
GO-2025-4116 Potential denial of service in golang.org/x/crypto/ssh/agent