GO-2026-5932: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
Published Jul 7, 2026
·Updated
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
Affected Software
2 affected componentsFixes available
go/golang.org/x/crypto<0.58.1-0.20261009181718-2f1f834330b2
0.58.1-0.20261009181718-2f1f834330b2
go/golang.org/x/crypto/openpgp*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/cryptoto a version that resolves this vulnerability.Fixed in 0.58.1-0.20261009181718-2f1f834330b2
Event History
Jul 7, 2026
Advisory Published
via OSV·10:15 PM
Data Sourced
via OSV·10:15 PM
DescriptionAffected Software