CVE-2026-42508Critical· 9.1▾ MidnightPreviously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 7.3%
9.1 → 7.4
critical → high
7.4 → 9.1
high → critical
9.1 → 7.4
critical → high
7.4 → 9.1
high → critical
9.1 → 7.4
critical → high
7.4 → 9.1
high → critical
Last analysed / modified upstream
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
crypto < 0.52.0Upgrade past the affected range:
crypto 0.52.0Affected packages:
golang.org/x/crypto/ssh/knownhosts < 0.52.0Patched in:
golang.org/x/crypto/ssh/knownhosts 0.52.0Source: https://github.com/advisories/GHSA-5cgq-3rg8-m6cv
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33810High· 8.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
CVE-2026-39832Critical· 9.1When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request
CVE-2026-39830Critical· 9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
CVE-2026-39835Medium· 5.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
CVE-2026-27137High· 7.5When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…
CVE-2026-39829High· 7.5The RSA and DSA public key parsers did not enforce size limits on key parameters