CVE-2026-42508

Aliases:GO-2026-5021GHSA-5cgq-3rg8-m6cv
Advisory lineage Upstream: 0 Downstream: 60
Analyzed
Published: 22 May 2026, 02:31
Last modified:22 Jul 2026, 12:08

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
0.47% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 May 2026, 02:31
Published
Vulnerability first disclosed
22 Jul 2026, 12:08
Last Modified
Vulnerability information updated

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.47%• Percentile: 37%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • golang•crypto

    < 0.52.0

  • golang.org/x•crypto

    < 0.52.0

  • golang.org/x/crypto/ssh•knownhosts

    < 0.52.0

  • golang.org/x/crypto•golang.org/x/crypto/ssh/knownhosts

    < 0.52.0

References (33)