---
id: "GO-2026-5932"
kind: "vulnerability"
aliases: ["GO-2026-5932"]
title: "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "golang.org/x/crypto", "fixed": ["0.58.1-0.20261009181718-2f1f834330b2"], "affected": "< 0.58.1-0.20261009181718-2f1f834330b2", "ecosystem": "go"}, {"name": "golang.org/x/crypto/openpgp", "fixed": [], "affected": "all versions", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "golang-x-crypto", "openpgp", "package"]
not_affected_if: ["no-openpgp-import"]
published_at: "2026-07-07T22:15:29+00:00"
first_seen_at: "2026-11-02T22:26:59+00:00"
updated_at: "2026-11-02T22:27:17+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-5932", "first_seen_at": "2026-11-02T22:26:59+00:00"}]
---

# The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

The golang.org/x/crypto/openpgp package is unmaintained and unsafe by design, with numerous known security issues. The advisory does not name a specific exploit or what an attacker can gain beyond these general flaws.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:golang.org/x/crypto affected < 0.58.1-0.20261009181718-2f1f834330b2 fixed 0.58.1-0.20261009181718-2f1f834330b2
- go:golang.org/x/crypto/openpgp affected all versions fixed ?

## How to check

- Search the codebase for imports of `golang.org/x/crypto/openpgp`.
- Run `go list -m golang.org/x/crypto` and compare against the fixed version.

## Fix

- Migrate to a maintained fork: github.com/ProtonMail/go-crypto/openpgp, which the advisory describes as a drop-in replacement.
- golang.org/x/crypto: move to `0.58.1-0.20261009181718-2f1f834330b2` or later.

## Timeline

- 2026-11-02T22:26:59+00:00 govuln https://pkg.go.dev/vuln/GO-2026-5932

## From the sources

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_