[release/2.2] vendor: golang.org/x/crypto v0.53.0#13607
Merged
Conversation
Similar to 9838a32 on main; golang.org/x/crypto < v0.52.0 contains various vulnerabilities; those do NOT impact containerd, but may show up as vulnerability in scanners; === Symbol Results === No vulnerabilities found. === Package Results === No other vulnerabilities found. === Module Results === Vulnerability containerd#1: GO-2026-5033 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent More info: https://pkg.go.dev/vuln/GO-2026-5033 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#2: GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5023 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#3: GO-2026-5021 Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts More info: https://pkg.go.dev/vuln/GO-2026-5021 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#4: GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5020 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#5: GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5019 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#6: GO-2026-5018 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5018 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#7: GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5017 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#8: GO-2026-5016 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5016 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#9: GO-2026-5015 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5015 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#10: GO-2026-5014 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5014 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#11: GO-2026-5013 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2026-5013 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#12: GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent More info: https://pkg.go.dev/vuln/GO-2026-5006 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Vulnerability containerd#13: GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent More info: https://pkg.go.dev/vuln/GO-2026-5005 Module: golang.org/x/crypto Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Your code is affected by 0 vulnerabilities. This scan also found 0 vulnerabilities in packages you import and 13 vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities. Signed-off-by: Sebastiaan van Stijn <[email protected]>
mxpv
approved these changes
Jun 17, 2026
AkihiroSuda
approved these changes
Jun 18, 2026
github-project-automation
Bot
moved this from Needs Triage
to Review In Progress
in Pull Request Review
github-project-automation
Bot
moved this from Review In Progress
to Done
in Pull Request Review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Similar to 9838a32 on main;
golang.org/x/crypto < v0.52.0 contains various vulnerabilities; those do NOT impact containerd, but may show up as vulnerability in scanners;