CVE-2026-42508: Golang.org/x/crypto Remote Code Execution Vulnerability

Q: What is CVE-2026-42508?

CVE-2026-42508 is a security vulnerability in Golang.org/x/crypto involving golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status under CWE-295: Improper Certificate Validation.

Q: Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.52.0 across affected packages: golang.org/x/crypto.

Q: What version fixes CVE-2026-42508?

Upgrading to 0.52.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.52.0. Upgrade your dependency to 0.52.0 or later.

Q: What is the CVSS score of CVE-2026-42508?

CVE-2026-42508 has a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Q: What CWE is associated with CVE-2026-42508?

CVE-2026-42508 is classified under CWE-295: Improper Certificate Validation (The product does not validate, or incorrectly validates, a certificate.).

Q: How can I check Go dependencies for CVE-2026-42508?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-5cgq-3rg8-m6cv

CVSS 9.1

CWE-295

Published 2026-06-25

Advisory Summary

CVE-2026-42508 is a CRITICAL (CVSS 9.1) remote code execution vulnerability (CWE-295: Improper Certificate Validation) affecting Golang.org/x/crypto libraries in the Go ecosystem. The issue involves golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status. Remediation is available by upgrading affected packages to version 0.52.0.

CVE-2026-42508 at a Glance

CVE Identifier CVE-2026-42508

GHSA Identifier GHSA-5cgq-3rg8-m6cv

Severity CRITICAL

CVSS v3.1 Base Score 9.1

CWE Classification CWE-295: Improper Certificate Validation

Affected Product Golang.org/x/crypto

Package Ecosystem Go

Published Date 2026-06-25

Last Updated 2026-07-17

Security Impact

CVSS: 9.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2026-42508

To remediate this vulnerability, upgrade all affected Golang.org/x/crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

golang.org/x/crypto fixed: 0.52.0

Upgrade golang.org/x/crypto to 0.52.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for golang.org/x/crypto

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-42508, inspect your project dependencies for Golang.org/x/crypto:

inspect dependencies for golang.org/x/crypto

Analyze the terminal output to locate any version of Golang.org/x/crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.52.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-295: Improper Certificate Validation, where the product does not validate, or incorrectly validates, a certificate. In Golang.org/x/crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVE-2026-42508 Affected Golang.org/x/crypto Versions

1 component(s)

Fixed Versions:

0.52.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
golang.org/x/crypto golang/golang.org/x/crypto	Go	< 0.52.0	0.52.0

References

go.dev/cl/781220 WEB

https://go.dev/cl/781220

NVD — CVE-2026-42508 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-42508

Golang.org/x/crypto Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json

pkg.go.dev/vuln/go-2026-5021 WEB

https://pkg.go.dev/vuln/GO-2026-5021

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/a082jnz-LvI

go.dev/issue/79568 WEB

https://go.dev/issue/79568

cs.opensource.google/go/x/crypto PACKAGE

https://cs.opensource.google/go/x/crypto

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2480688

Golang.org/x/crypto Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-42508

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41066

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41064

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41036

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41031

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41019

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40945

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40262

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40138

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40118

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37387

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37123

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37072

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36808

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36797

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36796

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36651

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36648

access.redhat.com/errata/rhsa-2026:35... WEB

https://access.redhat.com/errata/RHSA-2026:35833

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26547

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26546

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:23264

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:23262

Frequently Asked Questions

What is CVE-2026-42508?

CVE-2026-42508 is a security vulnerability in Golang.org/x/crypto involving golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status under CWE-295: Improper Certificate Validation.

Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.52.0 across affected packages: golang.org/x/crypto.

What version fixes CVE-2026-42508?

Upgrading to 0.52.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.52.0. Upgrade your dependency to 0.52.0 or later.

What is the CVSS score of CVE-2026-42508?

CVE-2026-42508 has a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

What CWE is associated with CVE-2026-42508?

CVE-2026-42508 is classified under CWE-295: Improper Certificate Validation (The product does not validate, or incorrectly validates, a certificate.).

How can I check Go dependencies for CVE-2026-42508?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5cgq-3rg8-m6cv",
  "modified" : "2026-07-17T15:32:15Z",
  "published" : "2026-06-25T22:22:04Z",
  "aliases" : [ "CVE-2026-42508" ],
  "summary" : "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status",
  "details" : "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "golang.org/x/crypto"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.52.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2026-5021"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/issue/79568"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/781220"
  }, {
    "type" : "PACKAGE",
    "url" : "https://cs.opensource.google/go/x/crypto"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-42508"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41066"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41064"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41036"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41031"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41019"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40945"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40262"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40138"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40118"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37387"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37123"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37072"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36808"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36797"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36796"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36651"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36648"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:35833"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26547"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26546"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:23264"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:23262"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-295" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-25T22:22:04Z",
    "nvd_published_at" : "2026-05-22T04:16:25Z"
  }
}

CVSS V3

9.1 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Advisory Metadata

Source ID: GHSA-5cgq-3rg8-m6cv
Schema Version: 1.4.0
Published: 2026-06-25 22:22
Last Modified: 2026-07-17 15:32
Database Record File: advisories/github-reviewed/2026/06/GHSA-5cgq-3rg8-m6cv/GHSA-5cgq-3rg8-m6cv.json