Improper Revocation Check in Go Programming Language Affects Security
CVE-2026-42508

9.1CRITICAL

Key Information:

Vendor

Golang.org/x/crypto

Status
Golang.org/x/crypto/ssh/knownhosts
Vendor
CVE Published:
22 May 2026

What is CVE-2026-42508?

A flaw in the Go programming language allows for the improper management of revoked certificates, specifically related to the checking of 'SignatureKey' revocations. This vulnerability arises because previously revoked keys were not properly validated, which could lead to potential security issues.

Affected Version(s)

golang.org/x/crypto/ssh/knownhosts 0 < 0.52.0

References

https://go.dev/issue/79568
https://go.dev/cl/781220
https://groups.google.com/g/golang-announce/c/a082jnz-LvI

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.