---
id: GO-2026-5932
title: >-
  The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and
  has known security issues
summary: >-
  The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and
  has known security issues
severity: none
vendor: x
product: golang.org/x/crypto
ecosystem: go
affected:
  - golang.org/x/crypto
published: '2026-07-07'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5932'
references:
  - url: 'https://go.dev/issue/44226'
tags:
  - osv
  - go
ingestedAt: '2026-07-09T18:56:37.265Z'
---

## Overview

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

## Affected packages

- `golang.org/x/crypto`

## Remediation

Refer to the advisory for the patched release.