GO-2026-5932None▾ SunlitThe golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
golang.org/x/crypto < 0.58.1-0.20261009181718-2f1f834330b2golang.org/x/crypto/openpgpUpgrade to a patched release:
golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2Connected by shared product, vendor, weakness, or advisory.
CVE-2020-29652High· 7.5golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
CVE-2024-45337NoneMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
CVE-2026-46597High· 7.5Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
CVE-2026-97045NoneCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
CVE-2026-42500NonePanic when reading out of bound palette index in golang.org/x/image/bmp
CVE-2026-33812NoneExcessive memory allocation when decoding malicious SFNT in golang.org/x/image