When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/778642 | Issue Tracking |
| https://go.dev/issue/79435 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/a082jnz-LvI | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5006 | Vendor Advisory |
Configurations
History
28 May 2026, 15:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | |
| First Time |
Golang crypto
Golang |
|
| References | () https://go.dev/cl/778642 - Issue Tracking | |
| References | () https://go.dev/issue/79435 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/a082jnz-LvI - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-5006 - Vendor Advisory | |
| CWE | CWE-502 |
22 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
22 May 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 04:16
Updated : 2026-05-28 15:11
NVD link : CVE-2026-39832
Mitre link : CVE-2026-39832
CVE.ORG link : CVE-2026-39832
JSON object : View
Products Affected
golang
- crypto
CWE
CWE-502
Deserialization of Untrusted Data