CVE catalog

CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-go.cryptosid1:0.58.0-1fixed
Debiangolang-go.cryptoforky1:0.58.0-1fixed
Debiangolang-go.cryptotrixie1:0.25.0-1vulnerable
Debiangolang-go.cryptobookworm1:0.4.0-1vulnerable
Cpegolang-go.cryptoNot reportedNot reportedvulnerable
CpecryptoNot reported0.52.0fixed
Gogolang.org/x/cryptoNot reported0.52.0fixed
CpecryptoNot reported0.52.0fixed
Gogolang.org/x/cryptoNot reported0.52.0fixed
Ubuntugolang-go.cryptopro1:0.25.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.45.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1ubuntu0.1~esm1vulnerable
Ubuntulxdpro2.18-0ubuntu6vulnerable
Ubuntulxdpro2.19-0ubuntu1vulnerable
Ubuntulxdpro2.20-0ubuntu3vulnerable
Ubuntulxdpro2.20-0ubuntu4vulnerable
Ubuntulxdpro2.21-0ubuntu1vulnerable
Ubuntulxdpro2.21-0ubuntu2vulnerable
Ubuntulxdpro2.21-0ubuntu3vulnerable
Ubuntulxdpro2.21-0ubuntu4vulnerable
Ubuntulxdpro3.0.0~beta2-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta3-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta5-0ubuntu2vulnerable
Ubuntulxdpro3.0.0~beta7-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu2vulnerable
Ubuntulxdpro3.0.0-0ubuntu3vulnerable
Ubuntulxdpro3.0.0-0ubuntu4vulnerable
Ubuntulxdpro3.0.1-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.2-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm3vulnerable
Ubuntusnapdpro2.41+19.10.1vulnerable
Ubuntusnapdpro2.42.1+20.04vulnerable
Ubuntusnapdpro2.43.3+git1.8109f8vulnerable
Ubuntusnapdpro2.44~pre1+20.04vulnerable
Ubuntusnapdpro2.44+20.04vulnerable
Ubuntusnapdpro2.44.2+20.04vulnerable
Ubuntusnapdpro2.44.3+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04.2vulnerable
Ubuntusnapdpro2.46.1+20.04vulnerable
Ubuntusnapdpro2.47.1+20.04vulnerable
Ubuntusnapdpro2.48+20.04vulnerable
Ubuntusnapdpro2.48.3+20.04vulnerable
Ubuntusnapdpro2.49.2+20.04vulnerable
Ubuntusnapdpro2.51.1+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.2+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.3+20.04vulnerable
Ubuntusnapdpro2.54.3+20.04.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.2vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.3vulnerable
Ubuntusnapdpro2.55.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.58+20.04vulnerable
Ubuntusnapdpro2.58+20.04.1vulnerable
Ubuntusnapdpro2.61.3+20.04vulnerable
Ubuntusnapdpro2.62+20.04vulnerable
Ubuntusnapdpro2.63+20.04vulnerable
Ubuntusnapdpro2.63+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.65.3+20.04vulnerable
Ubuntusnapdpro2.66.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm1vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm3vulnerable
Ubuntugoogle-guest-agentpro20201217.02-0ubuntu1~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20210414.00-0ubuntu1~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20210629.00-0ubuntu1~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20220622.00-0ubuntu2~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20220622.00-0ubuntu2~20.04.2vulnerable
Ubuntugoogle-guest-agentpro20230426.00-0ubuntu2~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20231004.02-0ubuntu1~20.04.1vulnerable
Ubuntugoogle-guest-agentpro20231004.02-0ubuntu1~20.04.2vulnerable
Ubuntugoogle-guest-agentpro20231004.02-0ubuntu1~20.04.3vulnerable
Ubuntugoogle-guest-agentpro20231004.02-0ubuntu1~20.04.4vulnerable
Ubuntugoogle-guest-agentpro20240716.00-0ubuntu1~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20241011.01-0ubuntu1~20.04.1vulnerable
Ubuntugoogle-guest-agentpro20250116.00-0ubuntu1~20.04.0vulnerable
Ubuntugoogle-guest-agentpro20250116.00-0ubuntu1~20.04.0+esm1vulnerable
Ubuntugoogle-guest-agentpro20250116.00-0ubuntu1~20.04.0+esm2vulnerable
Ubuntugoogle-guest-agentpro20250116.00-0ubuntu1~20.04.0+esm3vulnerable
Ubuntugoogle-guest-agent22.0420210629.00-0ubuntu1vulnerable
Ubuntugoogle-guest-agent22.0420210629.00-0ubuntu2vulnerable
Ubuntugoogle-guest-agent22.0420220104.00-0ubuntu1vulnerable
Ubuntugoogle-guest-agent22.0420220104.00-0ubuntu2vulnerable
Ubuntugoogle-guest-agent22.0420220622.00-0ubuntu2~22.04.0vulnerable
Ubuntugoogle-guest-agent22.0420220622.00-0ubuntu2~22.04.1vulnerable
Ubuntugoogle-guest-agent22.0420230426.00-0ubuntu2~22.04.0vulnerable
Ubuntugoogle-guest-agent22.0420231004.02-0ubuntu1~22.04.1vulnerable
Ubuntugoogle-guest-agent22.0420231004.02-0ubuntu1~22.04.2vulnerable
Ubuntugoogle-guest-agent22.0420231004.02-0ubuntu1~22.04.3vulnerable
Ubuntugoogle-guest-agent22.0420231004.02-0ubuntu1~22.04.4vulnerable
Ubuntugoogle-guest-agent22.0420231004.02-0ubuntu1~22.04.5vulnerable
Ubuntugoogle-guest-agent22.0420240716.00-0ubuntu1~22.04.0vulnerable
Ubuntugoogle-guest-agent22.0420241011.01-0ubuntu1~22.04.0vulnerable
Ubuntugoogle-guest-agent22.0420250116.00-0ubuntu1~22.04.0vulnerable
Ubuntugoogle-guest-agent22.0420250116.00-0ubuntu1~22.04.1vulnerable
Ubuntugoogle-guest-agent22.0420250116.00-0ubuntu1~22.04.2vulnerable
Ubuntugoogle-guest-agent22.0420250116.00-0ubuntu1~22.04.3vulnerable
Ubuntugoogle-guest-agent22.0420250116.00-0ubuntu1~22.04.4vulnerable
Ubuntusnapd22.042.53+21.10ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu2vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu3vulnerable
Ubuntusnapd22.042.54.3+git19.g868fc21+22.04vulnerable
Ubuntusnapd22.042.54.3+git26.g360067e+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04.1vulnerable
Ubuntusnapd22.042.55.3+22.04vulnerable
Ubuntusnapd22.042.55.3+22.04ubuntu1vulnerable
Ubuntusnapd22.042.55.5+22.04vulnerable
Ubuntusnapd22.042.56.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.57.4+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.58+22.04vulnerable
Ubuntusnapd22.042.58+22.04.1vulnerable
Ubuntusnapd22.042.61.3+22.04vulnerable
Ubuntusnapd22.042.62+22.04vulnerable
Ubuntusnapd22.042.63+22.04vulnerable
Ubuntusnapd22.042.63+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.65.3+22.04vulnerable
Ubuntusnapd22.042.66.1+22.04vulnerable
Ubuntusnapd22.042.67.1+22.04vulnerable
Ubuntusnapd22.042.68.5+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.71+ubuntu22.04vulnerable
Ubuntusnapd22.042.72+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.74.1+ubuntu22.04.4vulnerable
Ubuntusnapd22.042.75.2+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.77.1+ubuntu22.04.1vulnerable
Ubuntugoogle-guest-agent24.0420230426.00-0ubuntu3vulnerable
Ubuntugoogle-guest-agent24.0420231004.02-0ubuntu1vulnerable
Ubuntugoogle-guest-agent24.0420231004.02-0ubuntu3vulnerable
Ubuntugoogle-guest-agent24.0420240213.00-0ubuntu1vulnerable
Ubuntugoogle-guest-agent24.0420240213.00-0ubuntu2vulnerable
Ubuntugoogle-guest-agent24.0420240213.00-0ubuntu3vulnerable
Ubuntugoogle-guest-agent24.0420240213.00-0ubuntu3.1vulnerable
Ubuntugoogle-guest-agent24.0420240213.00-0ubuntu3.2vulnerable
Ubuntugoogle-guest-agent24.0420240716.00-0ubuntu1~24.04.0vulnerable
Ubuntugoogle-guest-agent24.0420240716.00-0ubuntu1~24.04.1vulnerable
Ubuntugoogle-guest-agent24.0420241011.01-0ubuntu1~24.04.0vulnerable
Ubuntugoogle-guest-agent24.0420250116.00-0ubuntu1~24.04.0vulnerable
Ubuntugoogle-guest-agent24.0420250116.00-0ubuntu1~24.04.1vulnerable
Ubuntugoogle-guest-agent24.0420250116.00-0ubuntu1~24.04.2vulnerable
Ubuntugoogle-guest-agent24.0420250116.00-0ubuntu1~24.04.3vulnerable
Ubuntugoogle-guest-agent24.0420250116.00-0ubuntu1~24.04.4vulnerable
Ubuntusnapd24.042.60.4+23.10vulnerable
Ubuntusnapd24.042.61.3+24.04vulnerable
Ubuntusnapd24.042.62+24.04build1vulnerable
Ubuntusnapd24.042.63+24.04vulnerable
Ubuntusnapd24.042.63+24.04ubuntu0.1vulnerable
Ubuntusnapd24.042.63.1+24.04vulnerable
Ubuntusnapd24.042.65.3+24.04vulnerable
Ubuntusnapd24.042.66.1+24.04vulnerable
Ubuntusnapd24.042.67.1+24.04vulnerable
Ubuntusnapd24.042.68.5+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.71+ubuntu24.04vulnerable
Ubuntusnapd24.042.72+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.2vulnerable
Ubuntusnapd24.042.74.1+ubuntu24.04.4vulnerable
Ubuntusnapd24.042.75.2+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.76.3+ubuntu24.04vulnerable
Ubuntusnapd24.042.77.1+ubuntu24.04vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1ubuntu0.1vulnerable
Ubuntugoogle-guest-agent25.1020250116.00-0ubuntu2vulnerable
Ubuntugoogle-guest-agent25.1020250506.01-0ubuntu1vulnerable
Ubuntugoogle-guest-agent25.1020250506.01-0ubuntu1.1vulnerable
Ubuntugoogle-guest-agent25.1020250506.01-0ubuntu1.2vulnerable
Ubuntusnapd25.102.67.1+25.04vulnerable
Ubuntusnapd25.102.68.5+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.71+ubuntu25.10vulnerable
Ubuntusnapd25.102.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.72+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.73+ubuntu25.10vulnerable
Ubuntusnapd25.102.73+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.74.1+ubuntu25.10.4vulnerable
Ubuntusnapd25.102.75.2+ubuntu25.10vulnerable
Ubuntugolang-go.crypto26.101:0.47.0-1vulnerable
Ubuntugolang-go.crypto26.101:0.55.0-1vulnerable
Ubuntugoogle-guest-agent26.1020250506.01-0ubuntu2vulnerable
Ubuntugoogle-guest-agent26.1020250506.01-0ubuntu3vulnerable
Ubuntugoogle-guest-agent26.1020260819.00+~20260819.00-0ubuntu1vulnerable
Ubuntusnapd26.102.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.1vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.2vulnerable
Ubuntusnapd26.102.76.3+ubuntu26.10vulnerable
Ubuntusnapd26.102.77.1+ubuntu26.10.1vulnerable
Ubuntugoogle-guest-agent26.0420250506.01-0ubuntu1vulnerable
Ubuntugoogle-guest-agent26.0420250506.01-0ubuntu2vulnerable
Ubuntugoogle-guest-agent26.0420250506.01-0ubuntu2.1vulnerable
Ubuntusnapd26.042.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd26.042.72+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.73+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.74+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.042.75.2+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.76.3+ubuntu26.04vulnerable
Ubuntusnapd26.042.77.1+ubuntu26.04.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-go.cryptosourcesid1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourceforky1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcetrixie(unfixed)not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcebookworm(unfixed)not yet assignedNot reported[1137516]
CpecryptocpeNot reported0.52.0Not reportedNot reportedNot reported
Gogolang.org/x/cryptoGoNot reported0.52.0Not reportedGHSA-W879-237Q-WC7RNot reported
CpecryptocpeNot reported0.52.0Not reportedNVD-CVE-2026-39829Not reported
Gogolang.org/x/cryptoGoNot reported0.52.0Not reportedGO-2026-5018Not reported

[Debian bug #1137516]

Notes

[trixie] golang-go.crypto: Minor issue [bookworm] golang-go.crypto: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [golang-go.crypto]

    Details (4)
    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

[Debian 13 (Trixie)]

  • Source package: [golang-go.crypto]

    Details (4)
    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

Observed:

References