CVE-2026-46598

Description

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.41%• Percentile: 35%

Techniques & Countermeasures

• CWE-129•Improper Validation of Array Index

  The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Affected Systems

• chainguard•aactl

  < 0.4.12-r53

• chainguard•act

  < 0

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 1.3.1-r11 | < 0

• chainguard•agentbeat

  < 0

• chainguard•agentbeat-fips

  < 0

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ssm-agent

  < 3.3.4515.0-r2 | < 0

• chainguard•amazon-ssm-agent-ecs-exec

  < 0

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 0

• chainguard•amazon-ssm-agent-fips

  < 3.3.4515.0-r3 | < 0

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 0

• chainguard•apko-fips

  < 0

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apply-cve-bump

  < 0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  < 3.1.16-r3

• chainguard•argo-cd-3.1-compat

  < 3.1.16-r3

• chainguard•argo-cd-3.3-compat

  < 0

• chainguard•argo-cd-3.4

  < 0

• chainguard•argo-cd-3.4-compat

  < 0

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.2

  < 0

• chainguard•argo-cd-fips-3.2-compat

  < 0

• chainguard•argo-cd-fips-3.4

  < 0

• chainguard•argo-cd-fips-3.4-compat

  < 0

• chainguard•argo-events

  < 0

• chainguard•argo-events-fips

  < 0

• chainguard•argo-rollouts

  < 0

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-controller-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflows-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-fips-3.6

  < 3.6.19-r9

• chainguard•argocd-image-updater

  < 0

Showing first 50 affected entries in server-rendered view.

References (10)

• https://go.dev/issue/79596
• https://go.dev/cl/781360
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5033
• https://nvd.nist.gov/vuln/detail/CVE-2026-46598
• https://security-tracker.debian.org/tracker/CVE-2026-46598
• https://ubuntu.com/security/CVE-2026-46598
• https://www.cve.org/CVERecord?id=CVE-2026-46598
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46598.json