CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
References
Link Resource
https://go.dev/cl/781641 Issue Tracking
https://go.dev/cl/781661 Issue Tracking
https://go.dev/issue/79565 Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
https://pkg.go.dev/vuln/GO-2026-5018 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26546
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:29455
https://access.redhat.com/errata/RHSA-2026:35833
https://access.redhat.com/errata/RHSA-2026:36199
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36319
https://access.redhat.com/errata/RHSA-2026:36625
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:36883
https://access.redhat.com/errata/RHSA-2026:37072
https://access.redhat.com/errata/RHSA-2026:37123
https://access.redhat.com/errata/RHSA-2026:37268
https://access.redhat.com/errata/RHSA-2026:37271
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/errata/RHSA-2026:37278
https://access.redhat.com/errata/RHSA-2026:37286
https://access.redhat.com/errata/RHSA-2026:37296
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40969
https://access.redhat.com/errata/RHSA-2026:40972
https://access.redhat.com/errata/RHSA-2026:40974
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41055
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/security/cve/CVE-2026-39829
https://bugzilla.redhat.com/show_bug.cgi?id=2480681
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

History

20 Jul 2026, 12:18

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:40119', 'source': '0b0ca135-0b70-47e7-9f44-1890c2a1c46c'}
  • () https://access.redhat.com/errata/RHSA-2026:41055 -

17 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -
  • () https://access.redhat.com/errata/RHSA-2026:40972 -
  • () https://access.redhat.com/errata/RHSA-2026:41019 -
  • () https://access.redhat.com/errata/RHSA-2026:41031 -
  • () https://access.redhat.com/errata/RHSA-2026:41036 -
  • () https://access.redhat.com/errata/RHSA-2026:41066 -

16 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40118 -
  • () https://access.redhat.com/errata/RHSA-2026:40119 -
  • () https://access.redhat.com/errata/RHSA-2026:40262 -
  • () https://access.redhat.com/errata/RHSA-2026:40969 -
  • () https://access.redhat.com/errata/RHSA-2026:40974 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:37272 -
  • () https://access.redhat.com/errata/RHSA-2026:37278 -
  • () https://access.redhat.com/errata/RHSA-2026:37286 -
  • () https://access.redhat.com/errata/RHSA-2026:37296 -
  • () https://access.redhat.com/errata/RHSA-2026:37387 -

09 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36796 -
  • () https://access.redhat.com/errata/RHSA-2026:36797 -
  • () https://access.redhat.com/errata/RHSA-2026:36808 -
  • () https://access.redhat.com/errata/RHSA-2026:36820 -
  • () https://access.redhat.com/errata/RHSA-2026:36883 -
  • () https://access.redhat.com/errata/RHSA-2026:37072 -
  • () https://access.redhat.com/errata/RHSA-2026:37123 -
  • () https://access.redhat.com/errata/RHSA-2026:37268 -
  • () https://access.redhat.com/errata/RHSA-2026:37271 -

08 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36199 -
  • () https://access.redhat.com/errata/RHSA-2026:36207 -
  • () https://access.redhat.com/errata/RHSA-2026:36319 -
  • () https://access.redhat.com/errata/RHSA-2026:36625 -
  • () https://access.redhat.com/errata/RHSA-2026:36648 -

06 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:35833 -

01 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:26546 -
  • () https://access.redhat.com/errata/RHSA-2026:26547 -

30 Jun 2026, 03:19

Type Values Removed Values Added
CWE CWE-1284
References
  • () https://access.redhat.com/errata/RHSA-2026:29455 -
  • () https://access.redhat.com/security/cve/CVE-2026-39829 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2480681 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json -

02 Jun 2026, 16:33

Type Values Removed Values Added
First Time Golang crypto
Golang
References () https://go.dev/cl/781641 - () https://go.dev/cl/781641 - Issue Tracking
References () https://go.dev/cl/781661 - () https://go.dev/cl/781661 - Issue Tracking
References () https://go.dev/issue/79565 - () https://go.dev/issue/79565 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/a082jnz-LvI - () https://groups.google.com/g/golang-announce/c/a082jnz-LvI - Mailing List
References () https://pkg.go.dev/vuln/GO-2026-5018 - () https://pkg.go.dev/vuln/GO-2026-5018 - Vendor Advisory
CPE cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
CWE CWE-347

22 May 2026, 19:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5

22 May 2026, 04:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-05-22 04:16

Updated : 2026-07-20 12:18


NVD link : CVE-2026-39829

Mitre link : CVE-2026-39829

CVE.ORG link : CVE-2026-39829


JSON object : View

Products Affected

golang

  • crypto
CWE
CWE-347

Improper Verification of Cryptographic Signature

CWE-1284

Improper Validation of Specified Quantity in Input