OCPBUGS-92024: bump golang.org/x/crypto to v0.53.0 for CVE-2026-39829

[nader-ziada]

CVE-2026-39829

The RSA and DSA public key parsers in golang.org/x/crypto/ssh did not enforce size limits on key parameters, allowing a crafted public key to cause minutes of CPU consumption during signature verification.

Summary by CodeRabbit

• Chores
  • Updated several Go module dependencies to newer versions.
  • Improved consistency across transitive golang.org/x packages, including security- and tooling-related libraries.

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-92024, which is invalid:

• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Verified instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

CVE-2026-39829

The RSA and DSA public key parsers in golang.org/x/crypto/ssh did not enforce size limits on key parameters, allowing a crafted public key to cause minutes of CPU consumption during signature verification.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

Updates go.mod to bump golang.org/x/crypto and refresh several indirect golang.org/x/* dependencies.

Changes

Go module updates

Layer / File(s)	Summary
Refresh direct and indirect x packages go.mod	golang.org/x/crypto is bumped in the main require block, and multiple indirect golang.org/x/* versions are updated in the indirect require block.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• openshift/machine-api-provider-azure issue 178: Also targets the golang.org/x/crypto update reflected in this go.mod change.
• openshift/cluster-api-provider-gcp issue 256: Also focuses on bumping golang.org/x/crypto.
• openshift/cluster-baremetal-operator issue 536: Also concerns the golang.org/x/crypto update in go.mod.
• openshift/machine-config-operator issue 5506: Also matches the golang.org/x/crypto version bump here.
• openshift/oauth-server issue 206: Also addresses the same golang.org/x/crypto update.
• openshift/azure-service-operator issue 15: Also tracks a golang.org/x/crypto upgrade.
• openshift/assisted-installer issue 1404: Also aligns with the golang.org/x/crypto version update in this PR.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nrb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-92024. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

CVE-2026-39829

The RSA and DSA public key parsers in golang.org/x/crypto/ssh did not enforce size limits on key parameters, allowing a crafted public key to cause minutes of CPU consumption during signature verification.

Summary by CodeRabbit

• Chores
• Updated several Go module dependencies to newer versions.
• Improved consistency across transitive golang.org/x packages, including security- and tooling-related libraries.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-92024, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

CVE-2026-39829

The RSA and DSA public key parsers in golang.org/x/crypto/ssh did not enforce size limits on key parameters, allowing a crafted public key to cause minutes of CPU consumption during signature verification.

Summary by CodeRabbit

• Chores
• Updated several Go module dependencies to newer versions.
• Improved consistency across transitive golang.org/x packages, including security- and tooling-related libraries.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[nader-ziada]

/retest

[nader-ziada]

/retest

[openshift-ci]

@nader-ziada: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/regression-clusterinfra-azure-ipi-mapi-1of3	fc5d7b5	link	false	/test regression-clusterinfra-azure-ipi-mapi-1of3
ci/prow/regression-clusterinfra-azure-ipi-mapi-3of3	fc5d7b5	link	false	/test regression-clusterinfra-azure-ipi-mapi-3of3

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[nader-ziada]

/retest-required

[nader-ziada]

@theobarberbany would you mind reviewing