golang.org/x/crypto vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46595Criticalgolang.org/x/crypto: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE-2026-42508Criticalgolang.org/x/crypto: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status CVE-2026-39834Criticalgolang.org/x/crypto: golang.org/x/crypto vulnerable to infinite loop on large channel writes CVE-2026-39831Criticalgolang.org/x/crypto: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed CVE-2026-39829Highgolang.org/x/crypto: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS CVE-2026-39830Criticalgolang.org/x/crypto: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses CVE-2026-39827Mediumgolang.org/x/crypto: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS CVE-2026-39835Mediumgolang.org/x/crypto: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow CVE-2026-39828Mediumgolang.org/x/crypto: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions CVE-2026-46597Highgolang.org/x/crypto: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic CVE-2026-39832Criticalgolang.org/x/crypto: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys CVE-2026-39833Criticalgolang.org/x/crypto: golang.org/x/crypto doesn't enforce invoking key constraints CVE-2026-46598Mediumgolang.org/x/crypto: golang.org/x/crypto: Invoking pathological inputs can lead to client panic CVE-2025-47914Mediumgolang.org/x/crypto: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read CVE-2025-58181Mediumgolang.org/x/crypto: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption CVE-2025-22869Highgolang.org/x/crypto: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange CVE-2024-45337Criticalgolang.org/x/crypto: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2023-48795Mediumrussh: Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2017-3204Highgolang.org/x/crypto: golang.org/x/crypto/ssh Man-in-the-Middle attack CVE-2021-43565Highgolang.org/x/crypto: x/crypto/ssh vulnerable to panic via malformed packets CVE-2020-29652Highgolang.org/x/crypto: golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability CVE-2019-11841Mediumgolang.org/x/crypto: Golang/x/crypto message forgery vulnerability CVE-2019-11840Mediumgolang.org/x/crypto: golang.org/x/crypto/salsa20/salsa uses insufficiently random values CVE-2022-27191Highgolang.org/x/crypto: golang.org/x/crypto/ssh Denial of service via crafted Signer CVE-2020-7919Highgithub.com/helm/helm: Helm uses crypto package vulnerable to panic from malformed X.509 certificate

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo