github.com/smallstep/certificates vulnerabilities (Go)

4 vulnerabilities.

• github.com/smallstep/certificates Go Step CA affected by an index out of bounds panic in TPM attestation EKU validation CVE-2026-40097 Fix available 3.7 LowApril 10, 2026
• github.com/smallstep/certificates Go Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) CVE-2026-30836 Fix available 10.0 CriticalMarch 19, 2026
• github.com/smallstep/certificates Go Step CA Has Authorization Bypass in ACME and SCEP Provisioners CVE-2025-44005 Fix available 10.0 CriticalDecember 3, 2025
• github.com/smallstep/certificates Go Improper Authorization Check for SSH Certificate Revocation CVE-2025-66406 Fix available 5.0 MediumDecember 3, 2025