Update module golang.org/x/crypto to v0.52.0 [SECURITY] - #170
Open
renovate[bot] wants to merge 1 commit into
Open
Update module golang.org/x/crypto to v0.52.0 [SECURITY]#170renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
from
March 5, 2026 14:02
8a909bf to
3d89a8a
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
2 times, most recently
from
March 30, 2026 22:02
3d89a8a to
9838f39
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
2 times, most recently
from
April 27, 2026 21:31
9838f39 to
ca5b2e4
Compare
qiluo-msft
pushed a commit
to sonic-net/sonic-buildimage
that referenced
this pull request
Apr 29, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target #4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
vivekverma-arista
pushed a commit
to vivekverma-arista/sonic-buildimage
that referenced
this pull request
Apr 30, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
mhchann
pushed a commit
to mhchann/sonic-buildimage
that referenced
this pull request
May 7, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block. Signed-off-by: mhchann <mhchann082@gmail.com>
roger530-ho
pushed a commit
to roger530-ho/sonic-buildimage
that referenced
this pull request
Jun 23, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target sonic-net#4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
xdqi
pushed a commit
to canonical/sonic-buildimage
that referenced
this pull request
Jul 6, 2026
Why I did it gnoic is unused inside the PTF container, and its upstream (karimra/gnoic) has not cut a release containing the golang.org/x/crypto v0.45.0 fixes for CVE-2025-58181 (GHSA-j5w8-q4qc-rx2x) and CVE-2025-47914 (GHSA-f6x5-jh6r-wrfv). The latest tag v0.2.1 still ships x/crypto v0.43.0, and the renovate security PR (karimra/gnoic#170) is unmerged. Carrying a private patched build of an unused tool just to satisfy S360 scans is not worth the maintenance cost. How I did it Removed the gnoic build block from dockers/docker-ptf/Dockerfile.j2. Updated the Go-toolchain install comment to no longer mention gnoic. Removed the gnoic entry from files/build/versions-public/default/versions-git. Removed the gnoic line from ThirdPartyLicenses.txt (the shared Apache 2.0 license body is preserved because entry Introduced Cavium target #4 apt-clean still uses it). grpcurl and gnmic are unaffected — they continue to be built from source with go get golang.org/x/...@latest && go mod tidy, which already covers the related CVEs flagged by S360. How to verify it grep -r gnoic dockers/docker-ptf/ files/build/versions-public/ ThirdPartyLicenses.txt returns nothing. Build docker-ptf; the resulting image no longer contains /usr/local/bin/gnoic. Re-run the S360 / Qualys ContainerImageScan against the new digest; CVE-2025-58181 and CVE-2025-47914 against /usr/local/bin/gnoic should disappear. Which release branch to backport (if applicable) N/A — master only. Older release branches do not contain the gnoic build block.
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
from
July 10, 2026 20:53
ca5b2e4 to
cdc0b3f
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
from
July 30, 2026 00:27
9288a78 to
cdc0b3f
Compare
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
from
July 30, 2026 00:27
cdc0b3f to
9288a78
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/go-golang.org-x-crypto-vulnerability
branch
2 times, most recently
from
July 31, 2026 21:58
9288a78 to
8e31a78
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.43.0→v0.52.0golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x
More information
Details
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv
More information
Details
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto vulnerable to infinite loop on large channel writes
CVE-2026-39834 / GHSA-rm3j-f69w-wqmq
More information
Details
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
CVE-2026-39828 / GHSA-45gg-vh54-h5m9
More information
Details
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
CVE-2026-39829 / GHSA-w879-237q-wc7r
More information
Details
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
CVE-2026-46597 / GHSA-q4h4-gmj2-qvw2
More information
Details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
CVE-2026-39831 / GHSA-89gr-r52h-f8rx
More information
Details
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
CVE-2026-42508 / GHSA-5cgq-3rg8-m6cv
More information
Details
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
CVE-2026-39835 / GHSA-78mq-xcr3-xm33
More information
Details
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
CVE-2026-46598 / GHSA-9m57-25v3-79x9
More information
Details
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
CVE-2026-39830 / GHSA-vgwf-h737-ff37
More information
Details
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
CVE-2026-39832 / GHSA-f5wc-c3c7-36mc
More information
Details
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
CVE-2026-46595 / GHSA-x527-x647-q7gg
More information
Details
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto doesn't enforce invoking key constraints
CVE-2026-39833 / GHSA-jppx-rxg9-jmrx
More information
Details
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
CVE-2026-39827 / GHSA-qpw4-5x99-6vjp
More information
Details
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.