Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
During certificate or signature verification, the library only checked the direct key (key), omitting verification of the revocation status of the associated CA signature key (key.SignatureKey). An attacker with access to a revoked CA SignatureKey could generate signatures or certificates that were incorrectly recognized as valid. After the fix, both fields — key and key.SignatureKey — are verified for presence on the revocation list.
An attacker can bypass certificate or CA key revocation verification mechanisms, leading to unauthorized access to protected resources or violation of digital signature integrity.
Apply patches available from the vendor according to references (https://go.dev/cl/781220, https://go.dev/issue/79568, https://pkg.go.dev/vuln/GO-2026-5021).
Applications using the Golang Crypto library — versions indicated in vendor references.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NGolang Crypto
APPGolang< 0.52.0
Related vulnerabilities
Golang Crypto: pominięcie ograniczeń przy przekazywaniu kluczy do zdalnego agenta SSH
Golang Crypto: brak wymuszenia ograniczenia ConfirmBeforeUse w NewKeyring()
Brak weryfikacji flagi User Presence w FIDO/U2F w Golang Crypto
Golang Crypto: resource leak przez niezamawiane odpowiedzi SSH global request
Integer overflow w Golang Crypto SSH — nieskończona pętla przy zapisie >4GB