{"id":"GO-2026-5932","title":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","summary":"The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues","severity":"none","vendor":"x","product":"golang.org/x/crypto","ecosystem":"go","affected":["golang.org/x/crypto"],"published":"2026-07-07","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5932","references":[{"url":"https://go.dev/issue/44226"}],"tags":["osv","go"],"ingestedAt":"2026-07-09T18:56:37.265Z","slug":"GO-2026-5932","body":"## Overview\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\n## Affected packages\n\n- `golang.org/x/crypto`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}