CVE Intelligence

Golang.org/x/crypto Golang.org/x/crypto/ssh/knownhosts vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Golang.org/x/crypto Golang.org/x/crypto/ssh/knownhosts: 1 record(s), with affected versions and fixes.

CVE-2026-42508 Critical · 9.1 CWE-295 May 22, 2026
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.