GO · JUNE 2026 · EARLY WARNING

golang.org/x/crypto Vulnerability: Monitor for Updates

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
golang.org/x/crypto (go)
Affected versions
< 0.0.0-20201216223049-8b5274cf687f or < 0.52.0 or >= 0.1.0, < 0.17.0 or < 0.0.0-20231218163308-9d2ee975ef9f or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.52.0 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.52.0 or < 0.45.0 or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20211202192323-5770296d904e or < 0.35.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190320223903-b7391e95e576 or < 0.52.0 or < 0.31.0 or < 0.52.0 or < 0.52.0 or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.52.0 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20200220183623-bac4c82f6975 or < 0.0.0-20170330155735-e4e2799dd7aa or < 0.0.0-20201216223049-8b5274cf687f or < 0.0.0-20220314234659-1baeb1ce4c0b or < 0.0.0-20190320223903-b7391e95e576 or < 0.0.0-20200124225646-8b5121be2f68 or < 0.0.0-20211202192323-5770296d904e or < 0.0.0-20190424203555-c05e17bb3b2d or < 0.17.0 or < 0.0.0-20220525230936-793ad666bf5e or < 0.31.0 or < 0.35.0 or < 0.43.0 or < 0.45.0 or < 0.45.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0 or < 0.52.0
Patched version
Not yet available
GHSA-VGWF-H737-FF37

An early warning has been issued for a potential vulnerability in golang.org/x/crypto that could lead to a server deadlock. Users of affected versions should take precautions.

What happened

An early warning has been issued regarding a potential vulnerability in the golang.org/x/crypto package. This vulnerability, tracked as GHSA-VGWF-H737-FF37, could allow a malicious SSH peer to send unsolicited global request responses, potentially filling an internal buffer and blocking the connection's read loop. This could result in a resource leak per connection as the blocked goroutine cannot be released by calling Close(). The issue is under investigation and has not been exploited in the wild.

The vulnerability affects specific versions of golang.org/x/crypto. Users of these versions are advised to monitor for updates and apply patches as they become available. The recommended action is to stay informed about the status of this vulnerability and take appropriate measures to secure systems that may be at risk.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If golang.org/x/crypto is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using golang.org/x/crypto with versions less than 0.0.0-20201216223049-8b5274cf687f or less than 0.52.0 or greater than or equal to 0.1.0 and less than 0.17.0 or any other affected version listed in the threat data.

What should I do right now?

Monitor for updates to golang.org/x/crypto and apply patches as they become available. Review your system's use of the package and assess potential exposure.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats