ByteOS Network

NVD Vulnerability Details :

CVE-2026-42508

Analyzed

Source-security@golang.org

Published At-22 May, 2026 | 04:16

Updated At-28 May, 2026 | 14:47

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CPE Matches

>>crypto>>Versions before 0.52.0(exclusive)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

Weaknesses

CWE ID	Type	Source
CWE-295	Primary	nvd@nist.gov

CWE ID: CWE-295

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://go.dev/cl/781220	security@golang.org	Issue Tracking
https://go.dev/issue/79568	security@golang.org	Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI	security@golang.org	Mailing List
https://pkg.go.dev/vuln/GO-2026-5021	security@golang.org	Vendor Advisory

Hyperlink: https://go.dev/cl/781220

Source: security@golang.org

Resource:

Issue Tracking

Hyperlink: https://go.dev/issue/79568

Source: security@golang.org

Resource:

Issue Tracking

Hyperlink: https://groups.google.com/g/golang-announce/c/a082jnz-LvI

Source: security@golang.org

Resource:

Mailing List

Hyperlink: https://pkg.go.dev/vuln/GO-2026-5021

Source: security@golang.org

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History