{"id":"GO-2026-5932","kind":"vulnerability","aliases":["GO-2026-5932"],"related":[],"title":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","summary":"The golang.org/x/crypto/openpgp package is unmaintained and unsafe by design, with numerous known security issues. The advisory does not name a specific exploit or what an attacker can gain beyond these general flaws.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"golang.org/x/crypto","fixed":["0.58.1-0.20261009181718-2f1f834330b2"],"affected":"< 0.58.1-0.20261009181718-2f1f834330b2","ecosystem":"go"},{"name":"golang.org/x/crypto/openpgp","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang-x-crypto","openpgp","package"],"not_affected_if":["no-openpgp-import"],"how_to_check":"- Search the codebase for imports of `golang.org/x/crypto/openpgp`.\n- Run `go list -m golang.org/x/crypto` and compare against the fixed version.","fix":"- Migrate to a maintained fork: github.com/ProtonMail/go-crypto/openpgp, which the advisory describes as a drop-in replacement.\n- golang.org/x/crypto: move to `0.58.1-0.20261009181718-2f1f834330b2` or later.","status":"open","published_at":"2026-07-07T22:15:29+00:00","first_seen_at":"2026-11-02T22:26:59+00:00","triaged_at":"2026-11-02T22:27:17+00:00","updated_at":"2026-11-02T22:27:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-02T22:27:17Z","model":"claude-haiku-5-5","output":{"fix":"- Migrate to a maintained fork: github.com/ProtonMail/go-crypto/openpgp, which the advisory describes as a drop-in replacement.\n- golang.org/x/crypto: move to `0.58.1-0.20261009181718-2f1f834330b2` or later.","reach":"unknown","title":"Go x/crypto openpgp package: unmaintained and unsafe, known security issues","impact":"medium","summary":"The golang.org/x/crypto/openpgp package is unmaintained and unsafe by design, with numerous known security issues. The advisory does not name a specific exploit or what an attacker can gain beyond these general flaws.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","golang-x-crypto","openpgp"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the advisory names no specific exploit or attacker capability","analyst_note":"Check the GO-2026-5932 page at https://pkg.go.dev/vuln/GO-2026-5932 for the specific security issues and whether the openpgp package has any fixed version, since the sources list the fix as unknown.","how_to_check":"- Search the codebase for imports of `golang.org/x/crypto/openpgp`.\n- Run `go list -m golang.org/x/crypto` and compare against the fixed version.\n- unknown for the exact exposure conditions beyond these checks.","plain_action":"","needs_analyst":true,"not_affected_if":["no-openpgp-import"],"who_is_affected":"Go projects that import golang.org/x/crypto/openpgp for OpenPGP operations are exposed; the advisory says the package has no fix and should not be used at all. Projects that do not import this package are not affected by it, and the x/crypto module version bump addresses only the module version listed in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":4223,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-5932':18A,21A '/protonmail/go-crypto/openpgp':108C '/x/crypto':24A '/x/crypto/openpgp':4A,27A,38B,72C 'advisori':52B 'aim':115C 'attack':62B 'beyond':65B 'consid':105C 'crypto':32B 'design':10A,45B,77C 'drop':120C 'drop-in':119C 'exploit':58B 'flaw':68B 'fork':113C 'gain':64B 'general':67B 'github.com':107C 'github.com/protonmail/go-crypto/openpgp':106C 'go':16A,19A,28B 'golang':30B 'golang-x-crypto':29B 'golang.org':3A,23A,26A,37B,71C 'golang.org/x/crypto':22A 'golang.org/x/crypto/openpgp':2A,25A,36B,70C 'interoper':96C 'issu':15A,50B,82C 'known':13A,48B,80C 'maintain':85C,103C,112C 'name':55B 'need':101C 'numer':47B,79C 'openpgp':33B,98C 'packag':5A,34B,39B,73C,104C,125C 'replac':122C 'requir':94C 'secur':14A,49B,81C 'specif':57B 'system':99C 'unmaintain':7A,41B 'unsaf':8A,43B,75C 'use':90C 'x':31B","nicknames":[],"mitigations":[],"who_affected":"Go projects that import golang.org/x/crypto/openpgp for OpenPGP operations are exposed; the advisory says the package has no fix and should not be used at all. Projects that do not import this package are not affected by it, and the x/crypto module version bump addresses only the module version listed in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["golangorgxcrypto","golangorgxcryptoopenpgp"],"ptokens":["crypto","golang","openpgp","org"],"labels":["go","golangxcrypto","openpgp","package","unknown"],"first_public_at":"2026-07-07T22:15:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-5932","url":"https://pkg.go.dev/vuln/GO-2026-5932","severity":null,"published_at":"2026-07-07T22:15:29+00:00","modified_at":"2026-11-02T22:01:43+00:00","first_seen_at":"2026-11-02T22:26:59+00:00","fetched_at":"2026-11-02T22:26:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}