{"id":"GO-2026-5932","aliases":[],"status":"published","title":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-07T22:15:29Z","modified":"2026-11-02T22:15:06Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.58.1-0.20261009181718-2f1f834330b2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.58.1-0.20261009181718-2f1f834330b2"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto/openpgp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://go.dev/issue/44226","tags":["report"]},{"url":"https://go.dev/issue/81227","tags":["web"]}],"sources":{"osv":[{"id":"GO-2026-5932","title":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","status":"published","published":"2026-07-07T22:15:29Z","modified":"2026-11-02T22:15:06.677088389Z","updated_at":"2026-11-03T00:03:07.015763Z"}]}}