Vulnerabilities in pkg:golang/software.sslmate.com/src/go-pkcs12

PACKAGE
Share
Advisory Summary

GHSA-mpwr-8vm7-h73f is a MODERATE authentication bypass vulnerability (CWE-20: Improper Input Validation) affecting package pkcs12 libraries in the Go ecosystem. The issue involves authentication bypass in decode functions. Remediation is available by upgrading affected packages to version 0.7.2.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:golang/software.sslmate.com/src/go-pkcs12

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:golang/software.sslmate.com/src/go-pkcs12. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-mpwr-8vm7-h73f - MODERATE package pkcs12: Authentication bypass in Decode functions

GHSA-mpwr-8vm7-h73f at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-mpwr-8vm7-h73f
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-20: Improper Input Validation
Affected Product package pkcs12
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-mpwr-8vm7-h73f

To remediate this vulnerability, upgrade all affected package pkcs12 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

software.sslmate.com/src/go-pkcs12 fixed: 0.7.2 
Upgrade software.sslmate.com/src/go-pkcs12 to 0.7.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for software.sslmate.com/src/go-pkcs12

How to Check if You Are Affected

To determine whether your application is affected by GHSA-mpwr-8vm7-h73f, inspect your project dependencies for package pkcs12:

inspect dependencies for software.sslmate.com/src/go-pkcs12

Analyze the terminal output to locate any version of package pkcs12 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.7.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In package pkcs12, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

`Decode`, `DecodeChain`, `DecodeTrustStore`, and `ToPEM` can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be tricked into accepting malicious PKCS#12 files. Users who only decode PKCS#12 files from trusted sources are not affected. Thanks to Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic) for finding and reporting the same issue in OpenSSL ([CVE-2026-34181](https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181)).

GHSA-mpwr-8vm7-h73f Affected package pkcs12 Versions

1 component(s)
Fixed Versions:
0.7.2
Product / Package Ecosystem Affected Versions Fixed Version
software.sslmate.com/src/go-pkcs12
golang/software.sslmate.com/src/go-pkcs12
Go
≥ 0.6.0
< 0.7.2
0.7.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f
package pkcs12 Source Repository REPOSITORY
https://github.com/SSLMate/go-pkcs12
openssl-library.org/news/vulnerabilitie... WEB
https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181

Frequently Asked Questions

What is GHSA-mpwr-8vm7-h73f?
GHSA-mpwr-8vm7-h73f is a security vulnerability in package pkcs12 involving Authentication bypass in Decode functions under CWE-20: Improper Input Validation.
Which package pkcs12 versions are affected?
Affected versions include releases prior to 0.7.2 across affected packages: software.sslmate.com/src/go-pkcs12.
What version fixes GHSA-mpwr-8vm7-h73f?
Upgrading to 0.7.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is software.sslmate.com/src/go-pkcs12 affected?
Yes, software.sslmate.com/src/go-pkcs12 is affected in releases prior to 0.7.2. Upgrade your dependency to 0.7.2 or later.
What CWE is associated with GHSA-mpwr-8vm7-h73f?
GHSA-mpwr-8vm7-h73f is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).
How can I check Go dependencies for GHSA-mpwr-8vm7-h73f?
Run the dependency tree command: 'inspect dependencies for software.sslmate.com/src/go-pkcs12'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mpwr-8vm7-h73f",
  "modified" : "2026-08-17T21:56:01Z",
  "published" : "2026-08-17T21:56:01Z",
  "aliases" : [ ],
  "summary" : "package pkcs12: Authentication bypass in Decode functions",
  "details" : "`Decode`, `DecodeChain`, `DecodeTrustStore`, and `ToPEM` can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be tricked into accepting malicious PKCS#12 files. Users who only decode PKCS#12 files from trusted sources are not affected.\n\nThanks to Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic) for finding and reporting the same issue in OpenSSL ([CVE-2026-34181](https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181)).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "software.sslmate.com/src/go-pkcs12"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.0"
      }, {
        "fixed" : "0.7.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/SSLMate/go-pkcs12"
  }, {
    "type" : "WEB",
    "url" : "https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T21:56:01Z",
    "nvd_published_at" : null
  }
}