← Vulnerability feed

Vulnerability record · CVE-2026-42508 · published 22 May 2026

CVE-2026-42508: Golang crypto improper certificate validation vulnerability

Golang · Crypto

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

9.1 CVSS 3.1 Critical EPSS 0.65% · top 50.7% CWE-295 · Improper certificate validation
9.1CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
49References
15 Sep 2026Last modified by NVD

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://go.dev/cl/781220 Issue Tracking
https://go.dev/issue/79568 Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
https://pkg.go.dev/vuln/GO-2026-5021 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:23262
https://access.redhat.com/errata/RHSA-2026:23264
https://access.redhat.com/errata/RHSA-2026:26546
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:35833
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:37072
https://access.redhat.com/errata/RHSA-2026:37123
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41064
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:43052
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:46885
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:47737
https://access.redhat.com/errata/RHSA-2026:49944
https://access.redhat.com/errata/RHSA-2026:51033
https://access.redhat.com/errata/RHSA-2026:51288
https://access.redhat.com/errata/RHSA-2026:52857
https://access.redhat.com/errata/RHSA-2026:52910
https://access.redhat.com/errata/RHSA-2026:54400
https://access.redhat.com/errata/RHSA-2026:57194
https://access.redhat.com/errata/RHSA-2026:59467

Track CVE-2026-42508 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-46595Golang crypto incorrect authorization vulnerabilityPreviously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than pu…EPSS 0.60%9.1CVE-2026-39834Golang crypto integer overflow vulnerabilityWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the w…EPSS 0.64%9.1CVE-2026-39830Golang crypto memory buffer overflow vulnerabilityA malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked gor…EPSS 0.62%9.1CVE-2026-39831Golang crypto missing authorization vulnerabilityThe Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence …EPSS 0.49%9.1CVE-2026-39832Golang crypto deserialization of untrusted data vulnerabilityWhen adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destinatio…EPSS 0.72%9.1CVE-2026-39833Golang crypto missing authorization vulnerabilityThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign …EPSS 0.49%8.1CVE-2017-3204Golang crypto vulnerabilityThe Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4…EPSS 3.2%7.5CVE-2026-78662Golang crypto allocation without limits vulnerabilityPreviously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingR…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2026-42508), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.