GO-2026-5021

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

At a glance

Published: 2026-05-22 02:08 UTC
Updated: 2026-09-15 10:41 UTC
CVE: CVE-2026-42508
Aliases: GHSA-5cgq-3rg8-m6cv

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.52.0

References

https://go.dev/issue/79568 REPORT
https://go.dev/cl/781220 FIX
https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database