CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Other sources
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-go.cryptoto a version that resolves this vulnerability.Fixed in 1:0.53.0-1 - Upgrade
Upgrade
go/golang.org/x/crypto/ssh/knownhoststo a version that resolves this vulnerability.Fixed in 0.52.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42508?
CVE-2026-42508 has a risk rating of 55, indicating it is a moderate vulnerability.
How do I fix CVE-2026-42508?
To remediate CVE-2026-42508, ensure that both the 'key' and 'key.SignatureKey' are properly checked for revocation in your implementation of golang.org/x/crypto/ssh/knownhosts.
What software is affected by CVE-2026-42508?
CVE-2026-42508 affects the golang.org/x/crypto/ssh/knownhosts module.
When was CVE-2026-42508 published?
CVE-2026-42508 was published on May 22, 2026.
What does CVE-2026-42508 involve?
CVE-2026-42508 involves an authentication bypass due to improper checking of a revoked 'SignatureKey' in the knownhosts module.