GO-2026-5932
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
What each source reports
OSV No score
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
- Record
GO-2026-5932- Updated
- 2026-11-03
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang.org/x/cryptoGo |
before 0.58.1-0.20261009181718-2f1f834330b2 | 0.58.1-0.20261009181718-2f1f834330b2 |
golang.org/x/crypto/openpgpGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts, references | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GO-2026-5932 is a vulnerability with no CVSS score yet in golang.org/x/crypto, published July 7, 2026. No source lists public exploit code. Fixed in golang.org/x/crypto 0.58.1-0.20261009181718-2f1f834330b2.