Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Go crypto library fix stops possible code execution

CVE-2026-46595 · published 10 days ago
Summary

The Go programming language’s cryptography package has been updated to close a security gap that could let an attacker run unwanted code. The fix applies to components such as Canonical’s Go runtime, Google Guest Agent and Snapd that rely on this package. Install the latest updates for these packages as soon as possible to stay protected.

What to do
  • Update x golang.org/x/crypto to version 0.52.0.
  • Update golang.org x to version 0.52.0.
  • Update canonical google-guest-agent to version 20250116.00-0ubuntu1~24.04.4.
  • Update canonical google-guest-agent to version 20250506.01-0ubuntu1.2.
  • Update canonical google-guest-agent to version 20250506.01-0ubuntu2.1.
  • Update canonical golang-go.crypto to version 1:0.47.0-1ubuntu0.1~esm1.
  • Update debian golang-go.crypto to version 1:0.52.0-1.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.3.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.3.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.5.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.5.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.4.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.4.
  • Update x golang.org/x/crypto to version v0.31.0-aikido.9.
  • Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.9.
  • Update x golang.org/x/crypto to version v0.45.0-aikido.3.
  • Update x rootio-golang.org/x/crypto to version v0.45.0-root.io.3.
  • Update x golang.org/x/crypto to version v0.27.0-aikido.1.
  • Update x rootio-golang.org/x/crypto to version v0.27.0-root.io.1.
  • Update x golang.org/x/crypto to version v0.21.0-aikido.1.
  • Update x rootio-golang.org/x/crypto to version v0.21.0-root.io.1.
  • Update x golang.org/x/crypto to version v0.35.0-aikido.6.
  • Update x golang.org/x/crypto to version v0.38.0-aikido.1.
  • Update x rootio-golang.org/x/crypto to version v0.38.0-root.io.1.
  • Update x golang.org/x/crypto to version v0.27.0-aikido.2.
  • Update x rootio-golang.org/x/crypto to version v0.27.0-root.io.2.
  • Update x golang.org/x/crypto to version v0.21.0-aikido.2.
  • Update x rootio-golang.org/x/crypto to version v0.21.0-root.io.2.
  • Update golang crypto to version 0.52.0 or later.
  • Update golang.org/x/crypto golang.org/x/crypto/ssh to version 0.52.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:20.04:LTS canonical golang-go.crypto All versions
Ubuntu:22.04:LTS canonical google-guest-agent All versions
Ubuntu:22.04:LTS canonical snapd All versions
Ubuntu:Pro:22.04:LTS canonical golang-go.crypto All versions
Ubuntu:24.04:LTS canonical google-guest-agent < 20250116.00-0ubuntu1~24.04.4
Fix: upgrade to 20250116.00-0ubuntu1~24.04.4
Ubuntu:24.04:LTS canonical snapd All versions
Ubuntu:Pro:24.04:LTS canonical golang-go.crypto All versions
Ubuntu:25.10 canonical golang-go.crypto All versions
Ubuntu:25.10 canonical google-guest-agent < 20250506.01-0ubuntu1.2
Fix: upgrade to 20250506.01-0ubuntu1.2
Ubuntu:25.10 canonical snapd All versions
Ubuntu:26.04:LTS canonical golang-go.crypto All versions
Ubuntu:26.04:LTS canonical google-guest-agent < 20250506.01-0ubuntu2.1
Fix: upgrade to 20250506.01-0ubuntu2.1
Ubuntu:26.04:LTS canonical snapd All versions
Go x golang.org/x/crypto < 0.52.0
Fix: upgrade to 0.52.0
Debian:11 debian golang-go.crypto All versions
Debian:12 debian golang-go.crypto All versions
Debian:13 debian golang-go.crypto All versions
Debian:14 debian golang-go.crypto < 1:0.52.0-1
Fix: upgrade to 1:0.52.0-1
Ubuntu:Pro:16.04:LTS canonical golang-go.crypto All versions
Ubuntu:Pro:16.04:LTS canonical lxd All versions
Ubuntu:Pro:16.04:LTS canonical snapd All versions
Ubuntu:Pro:16.04:LTS canonical google-guest-agent All versions
Ubuntu:Pro:18.04:LTS canonical lxd All versions
Ubuntu:Pro:18.04:LTS canonical snapd All versions
Ubuntu:Pro:18.04:LTS canonical golang-go.crypto All versions
Ubuntu:Pro:18.04:LTS canonical google-guest-agent All versions
Ubuntu:Pro:20.04:LTS canonical google-guest-agent All versions
Ubuntu:Pro:20.04:LTS canonical snapd All versions
– golang crypto < 0.52.0
cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
go golang.org x < 0.52.0
Fix: upgrade to 0.52.0
– golang.org/x/crypto golang.org/x/crypto/ssh < 0.52.0
Ubuntu:Pro:26.04:LTS canonical golang-go.crypto < 1:0.47.0-1ubuntu0.1~esm1
Fix: upgrade to 1:0.47.0-1ubuntu0.1~esm1
Root:Go x golang.org/x/crypto < v0.32.0-aikido.3
< v0.32.0-aikido.5
< v0.32.0-aikido.4
< v0.31.0-aikido.9
< v0.45.0-aikido.3
< v0.27.0-aikido.1
< v0.21.0-aikido.1
< v0.35.0-aikido.6
< v0.38.0-aikido.1
< v0.27.0-aikido.2
< v0.21.0-aikido.2
Fix: upgrade to v0.32.0-aikido.3
Root:Go x rootio-golang.org/x/crypto < v0.32.0-root.io.3
< v0.32.0-root.io.5
< v0.32.0-root.io.4
< v0.31.0-root.io.9
< v0.45.0-root.io.3
< v0.27.0-root.io.1
< v0.21.0-root.io.1
< v0.38.0-root.io.1
< v0.27.0-root.io.2
< v0.21.0-root.io.2
Fix: upgrade to v0.32.0-root.io.3
Original advisory text
CVE-2026-46595 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2026-46595 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
CWE-303Incorrect Implementation of Authentication Algorithm
Timeline
Published28 Oct 2026
Updated4 Nov 2026
First seen22 May 2026
Sources
DEBIAN-CVE-2026-46595 · OSV
GO-2026-5023 · OSV
CVE-2026-46595 · NVD
GHSA-x527-x647-q7gg · GHSA
CVE-2026-46595 · MITRE
CVE-2026-46595 · OSV
ROOT-APP-GOBINARY-CVE-2026-46595 · OSV
UBUNTU-CVE-2026-46595 · OSV
Track software like this
Free during beta