Is golang.org/x/crypto/ssh/knownhosts affected by CVE-2026-42508?

Go golang.org/x/crypto/ssh/knownhosts is affected in < 0.52.0.

Is CVE-2026-42508 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 7.3%.

critical

CVE-2026-42508

Q: Is CVE-2026-42508 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 7.3%.

Go · golang.org/x/crypto/ssh/knownhosts • Go · golang.org/x/crypto

Summary

golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status

Severity: critical
CVSS: 9.1
EPSS: 7.3% (p94)
CWE: CWE-295
Also known as: GHSA-5cgq-3rg8-m6cv, GO-2026-5021
Published: 2026-06-25
Updated: 2026-06-25

Advisory details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

References

Related advisories

CVE-2026-46428 — critical · crates.io/lettre
CVE-2026-55215 — high · npm/mariadb
CVE-2026-56820 — high · Maven/io.netty:netty-handler-ssl-ocsp
CVE-2026-54481 — high · Go/code.gitea.io/gitea
CVE-2026-61668 — high · PyPI/DIRAC
CVE-2026-55436 — high · Go/github.com/coder/coder/v2
CVE-2026-49283 — high · Packagist/simplesamlphp/saml2
CVE-2026-63336 — medium · Maven/com.rabbitmq:amqp-client

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.