GHSA-w879-237q-wc7r
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-39829
- Alias
- GO-2026-5018
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.52.0 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-39829 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:37387 WEB
- https://access.redhat.com/errata/RHSA-2026:40118 WEB
- https://access.redhat.com/errata/RHSA-2026:40119 WEB
- https://access.redhat.com/errata/RHSA-2026:40262 WEB
- https://access.redhat.com/errata/RHSA-2026:40945 WEB
- https://access.redhat.com/errata/RHSA-2026:40969 WEB
- https://access.redhat.com/errata/RHSA-2026:40972 WEB
- https://access.redhat.com/errata/RHSA-2026:40974 WEB
- https://access.redhat.com/errata/RHSA-2026:41019 WEB
- https://access.redhat.com/errata/RHSA-2026:41031 WEB
- https://access.redhat.com/errata/RHSA-2026:41036 WEB
- https://access.redhat.com/errata/RHSA-2026:41055 WEB
- https://access.redhat.com/errata/RHSA-2026:41066 WEB
- https://access.redhat.com/security/cve/CVE-2026-39829 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2480681 WEB
- https://cs.opensource.google/go/x/crypto PACKAGE
- https://go.dev/cl/781641 WEB
- https://go.dev/cl/781661 WEB
- https://go.dev/issue/79565 WEB
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB
- https://pkg.go.dev/vuln/GO-2026-5018 WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json WEB
- https://access.redhat.com/errata/RHSA-2026:26546 WEB
- https://access.redhat.com/errata/RHSA-2026:26547 WEB
- https://access.redhat.com/errata/RHSA-2026:29455 WEB
- https://access.redhat.com/errata/RHSA-2026:35833 WEB
- https://access.redhat.com/errata/RHSA-2026:36199 WEB
- https://access.redhat.com/errata/RHSA-2026:36207 WEB
- https://access.redhat.com/errata/RHSA-2026:36319 WEB
- https://access.redhat.com/errata/RHSA-2026:36625 WEB
- https://access.redhat.com/errata/RHSA-2026:36648 WEB
- https://access.redhat.com/errata/RHSA-2026:36651 WEB
- https://access.redhat.com/errata/RHSA-2026:36796 WEB
- https://access.redhat.com/errata/RHSA-2026:36797 WEB
- https://access.redhat.com/errata/RHSA-2026:36808 WEB
- https://access.redhat.com/errata/RHSA-2026:36820 WEB
- https://access.redhat.com/errata/RHSA-2026:36883 WEB
- https://access.redhat.com/errata/RHSA-2026:37072 WEB
- https://access.redhat.com/errata/RHSA-2026:37123 WEB
- https://access.redhat.com/errata/RHSA-2026:37268 WEB
- https://access.redhat.com/errata/RHSA-2026:37271 WEB
- https://access.redhat.com/errata/RHSA-2026:37272 WEB
- https://access.redhat.com/errata/RHSA-2026:37278 WEB
- https://access.redhat.com/errata/RHSA-2026:37286 WEB
- https://access.redhat.com/errata/RHSA-2026:37296 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |