NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2026-42508: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

criticalCVSS 3.1 9.1GHSA-5cgq-3rg8-m6cv

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Published Jun 25, 2026 · Updated Jul 17, 2026

Affected packages

golang.org/x/crypto

Ecosystem
Go
Affected
< 0.52.0
Fixed in
0.52.0
Check
go list -m golang.org/x/crypto

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries