--- title: "CVE-2026-42508: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status" url: https://erroneo.us/security/cve/CVE-2026-42508/ description: "CVE-2026-42508 (golang.org/x/crypto (Go)): Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the…" type: vulnerability-record section: "Security Digest" date_published: 2026-05-22 date_modified: 2026-09-15 publisher: erroneo.us author: erroneo.us Security Desk cve: "CVE-2026-42508" kev: false cvss: 7.4 epss: 0.00654 license: All rights reserved. Quote with attribution and a link. --- # CVE-2026-42508: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status **Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.) ## Should you act? - No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected. - EPSS 0.7% , percentile 51: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 51% of all scored CVEs (moderate). EPSS is a probability, not a verdict. - Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it. - Only applies if your dependency tree includes golang.org/x/crypto (Go) < 0.52.0, fixed in 0.52.0 . Check your lockfile, including transitive dependencies. ## What it is Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. ## Affected packages - Go `golang.org/x/crypto` < 0.52.0 → fixed: 0.52.0 ## Affected products (CVE record) - golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts: < 0.52.0 ## Severity - CISA-ADP CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` - redhat-SADP CVSS 3.1: 7.4 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` - GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` ## Exploitation - CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA). - CISA SSVC assessment: exploitation none , automatable yes , technical impact total . - FIRST EPSS (model of 2026-10-21): 0.65% probability of exploitation activity in the next 30 days; percentile 51. ## Sources - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41019) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36796) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37072) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:35833) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:51288) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:49944) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:67450) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37123) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:61314) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36808) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:66521) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:51033) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:59467) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:66022) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43692) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41064) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:47737) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:54400) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26546) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26547) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36651) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40945) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40118) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23262) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23264) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:65126) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:60520) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36648) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41036) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:52857) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:52910) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37387) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41031) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42146) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43052) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42796) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41066) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40262) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36797) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:57194) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:46885) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:47735) - [GitHub Advisory GHSA-5cgq-3rg8-m6cv](https://github.com/advisories/GHSA-5cgq-3rg8-m6cv) - [CVE.org record CVE-2026-42508](https://www.cve.org/CVERecord?id=CVE-2026-42508) - [NVD entry CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508) - [go.dev](https://go.dev/issue/79568) - [go.dev](https://go.dev/cl/781220) - [groups.google.com](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [pkg.go.dev](https://pkg.go.dev/vuln/GO-2026-5021) - [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-42508) - [RHBZ#2480688](https://bugzilla.redhat.com/show_bug.cgi?id=2480688) - [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40138) --- Source page: https://erroneo.us/security/cve/CVE-2026-42508/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt