Live › vulnerability › GO-2026-5932
The golang.org/x/crypto/openpgp package is unmaintained and unsafe by design, with numerous known security issues. The advisory does not name a specific exploit or what an attacker can gain beyond these general flaws.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 22:26 UTC. All times on this page are UTC.
Go projects that import golang.org/x/crypto/openpgp for OpenPGP operations are exposed; the advisory says the package has no fix and should not be used at all. Projects that do not import this package are not affected by it, and the x/crypto module version bump addresses only the module version listed in the sources.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.58.1-0.20261009181718-2f1f834330b2 | 0.58.1-0.20261009181718-2f1f834330b2 |
| golang.org/x/crypto/openpgp | go | all versions | – |
golang.org/x/crypto/openpgp.go list -m golang.org/x/crypto and compare against the fixed version.0.58.1-0.20261009181718-2f1f834330b2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
This page as .md · .json · in your agent: get_signal("GO-2026-5932")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.