{"id":"GO-2026-5932","title":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","summary":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","severity":"none","vendor":"x","product":"golang.org/x/crypto","ecosystem":"go","affected":["golang.org/x/crypto < 0.58.1-0.20261009181718-2f1f834330b2","golang.org/x/crypto/openpgp"],"patched":["golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2"],"published":"2026-07-07","updated":"2026-11-02","sourceUpdated":"2026-11-02T22:15:06.677088389Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5932","references":[{"url":"https://go.dev/issue/44226"},{"url":"https://go.dev/issue/81227"}],"tags":["osv","go"],"ingestedAt":"2026-07-09T18:56:37.265Z","slug":"GO-2026-5932","body":"## Overview\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\n## Affected packages\n\n- `golang.org/x/crypto < 0.58.1-0.20261009181718-2f1f834330b2`\n- `golang.org/x/crypto/openpgp`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}