Repository navigation
CVEs reported in golang.org/x/crypto dependency #16
Description
CVE-2026-46595 reported in golang.org/x/crypto which is a 3rd party dependency of our Go code. It seems to be not applicable to us directly, however we want to update dependencies to play safe.
Activity
amc1999 commentedon Jul 16, 2026
To be clear: golang.org/x/crypto is a dependency of Go driver for MSSQL: github.com/go-sql-driver/mysql. By default openM++ is not using MSSQL database and also not using golang.org/x/crypto anywhere else. That seems to be diminishing the risk.
Full list of CVEs which are fixed:
golang.org/x/crypto: CVE-2026-39834 vulnerable to infinite loop on large channel writes
golang.org/x/crypto: CVE-2026-39831 FIDO/U2F security key physical presence check can be bypassed
golang.org/x/crypto: CVE-2026-46597 Invoking byte arithmetic causes underflow and panic
golang.org/x/crypto: CVE-2026-39833 doesn't enforce invoking key constraints
golang.org/x/crypto: CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS
golang.org/x/crypto: CVE-2026-42508 vulnerable to auth bypass via unenforced @Revoked status
golang.org/x/crypto: CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses
golang.org/x/crypto: CVE-2026-39832 doesn't drop invoking agent constraints when forwarding keys
golang.org/x/crypto: CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement