CVE-2026-39833: golang.org/x/crypto doesn't enforce invoking key constraints
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Published Jun 25, 2026 · Updated Jul 7, 2026
Affected packages
golang.org/x/crypto
- Ecosystem
- Go
- Affected
- < 0.52.0
- Fixed in
- 0.52.0
- Check
go list -m golang.org/x/crypto
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Go vulnerabilities
All Go entriesCVE-2026-39830
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
critical9.1Jun 25, 2026CVE-2026-39831
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
critical9.1Jun 25, 2026CVE-2026-39832
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
critical9.1Jun 25, 2026CVE-2026-39834
golang.org/x/crypto vulnerable to infinite loop on large channel writes
critical9.1Jun 25, 2026CVE-2026-42508
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
critical9.1Jun 25, 2026CVE-2026-46595
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
critical10.0Jun 25, 2026