Public Key Parser Vulnerability in Go by Google

CVE-2026-39829

What is CVE-2026-39829?

The public key parsers in Go lacked proper enforcement of size limits on RSA and DSA key parameters. An attacker could exploit this by providing a malformed public key containing an excessively large modulus or DSA parameter, leading to significant CPU resource consumption during the signature verification process. This vulnerability could be triggered by unauthenticated clients during public key authentication, potentially resulting in substantial delays in system responses. Mitigations have been implemented to restrict RSA moduli to a maximum of 8192 bits, and DSA parameters have been aligned with FIPS 186-2 standards.

References