Bump golang.org/x/crypto to v0.52.0 (fixes SSH CVE batch) - #318
Merged
Conversation
Closes the May 2026 batch of golang.org/x/crypto/ssh advisories (CVE-2026-46597, -46595, -42508, -39829..-39834), all fixed in v0.52.0. gnetcli uses both the SSH client (pkg/streamer/ssh) and server (pkg/gswitch, internal/gvendor), so the server-side auth-bypass and DoS issues apply directly. Bumped x/crypto 0.14.0 -> 0.52.0 in the root module and in the benchmarks/ and examples/netsshsetup/ submodules; go mod tidy pulled the transitive x/net, x/sys, x/sync, x/text updates and raised the go directive in the submodules to satisfy the new x/crypto minimum. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
grigory51
changed the title
gescheit
approved these changes
Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A security alert reported 9 CVEs in
golang.org/x/crypto/ssh— CVE-2026-46597, -46595, -42508, -39829, -39830, -39831, -39832, -39833, -39834. These are a single May 2026 batch, all fixed in v0.52.0. It includes critical issues (CVSS 9.1): FIDO/U2F User Presence flag bypass, DoS via integer overflow on >4GB SSH channel writes, unenforced@revokedin knownhosts, and an AES-GCM decoder panic.gnetcli pinned
x/crypto v0.14.0and uses both the SSH client (pkg/streamer/ssh) and server (pkg/gswitch,internal/gvendor), so the server-side auth-bypass and DoS issues apply directly.How it was fixed
Bumped
golang.org/x/cryptotov0.52.0in all three modules (root,benchmarks/,examples/netsshsetup/).go mod tidypulled the transitive updates (x/net,x/sys,x/sync,x/text) and raised the go directive in the submodules to satisfy the new x/crypto minimum. No other dependencies were touched — only what closes the alert.Verification
go build,go vet,go mod verify— cleango test ./...— all green, includingpkg/streamer/sshandpkg/serverexamples/netsshsetupbuildsKnown (not a regression from this PR)
benchmarks/does not build: the module pins the publishedannetutil/gnetcli v1.0.3, whosemain.gocalls the staleexpr.NewSimpleExprLast200()/FromPatternAPI. The error is purely a gnetcli API drift; x/crypto is indirect there and updated correctly. Already broken before this change; out of scope.🤖 Generated with Claude Code