---
id: GO-2026-5932
title: >-
  The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and
  has known security issues
summary: >-
  The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and
  has known security issues
severity: none
vendor: x
product: golang.org/x/crypto
ecosystem: go
affected:
  - golang.org/x/crypto < 0.58.1-0.20261009181718-2f1f834330b2
  - golang.org/x/crypto/openpgp
patched:
  - golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2
published: '2026-07-07'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:15:06.677088389Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5932'
references:
  - url: 'https://go.dev/issue/44226'
  - url: 'https://go.dev/issue/81227'
tags:
  - osv
  - go
ingestedAt: '2026-07-09T18:56:37.265Z'
---

## Overview

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

## Affected packages

- `golang.org/x/crypto < 0.58.1-0.20261009181718-2f1f834330b2`
- `golang.org/x/crypto/openpgp`

## Remediation

Upgrade to a patched release:

- `golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2`