go package report

Is golang.org/x/crypto safe?

golang.org/x/crypto (go) has 32 known vulnerabilities, the worst rated CRITICAL. Upgrade to 0.58.1-0.20261009181718-2f1f834330b2 or later to clear all of them. No malicious-package signal is recorded.

// reach

4 direct dependencies

3 carry known advisories, worst CRITICAL

3,329 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.

cvss

9.1

critical

CVSS v3.1 base score out of 10

epss

0.68%

medium

chance of exploitation in 30 days, 53rd percentile of all CVEs

xyz score

5.0

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-vgwf-h737-ff37, the advisory selected below

// 32 advisories

GHSA-vgwf-h737-ff37

CRITICALGitHub ratingCVE-2026-39830

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

Full advisory text at GitHub advisory or NVD.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

// questions

Is golang.org/x/crypto safe to install?

CyberXYZ does not call a package safe in absolute terms. It records 32 known vulnerabilities for golang.org/x/crypto (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.

Does golang.org/x/crypto have known vulnerabilities?

Yes. CyberXYZ records 32 known vulnerabilities for golang.org/x/crypto (go), the worst rated CRITICAL. These include GHSA-vgwf-h737-ff37, GHSA-f5wc-c3c7-36mc, GHSA-5cgq-3rg8-m6cv, GHSA-x527-x647-q7gg, GHSA-rm3j-f69w-wqmq.

Which version of golang.org/x/crypto should I use?

0.58.1-0.20261009181718-2f1f834330b2 or later clears every advisory recorded for golang.org/x/crypto (go). Check the release you pick before installing it.

How do I check golang.org/x/crypto before installing?

Search golang.org/x/crypto in CyberXYZ Check at https://cyberxyz.io/check?q=golang.org%2Fx%2Fcrypto. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

Checked 2026-11-14 at 13:24 UTC. The most recent advisory here was published 2026-09-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.