CVE catalog

CVE-2026-39833

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication

[CVE catalog]

Severity
Critical · CVSS 9.1
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-go.cryptosid1:0.58.0-1fixed
Debiangolang-go.cryptoforky1:0.58.0-1fixed
Debiangolang-go.cryptotrixie1:0.25.0-1vulnerable
Debiangolang-go.cryptobookworm1:0.4.0-1vulnerable
Cpegolang-go.cryptoNot reportedNot reportedvulnerable
CpecryptoNot reported0.52.0fixed
Gogolang.org/x/cryptoNot reported0.52.0fixed
Ubuntugolang-go.cryptopro1:0.25.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.45.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1ubuntu0.1~esm1fixed
Ubuntulxdpro2.18-0ubuntu6vulnerable
Ubuntulxdpro2.19-0ubuntu1vulnerable
Ubuntulxdpro2.20-0ubuntu3vulnerable
Ubuntulxdpro2.20-0ubuntu4vulnerable
Ubuntulxdpro2.21-0ubuntu1vulnerable
Ubuntulxdpro2.21-0ubuntu2vulnerable
Ubuntulxdpro2.21-0ubuntu3vulnerable
Ubuntulxdpro2.21-0ubuntu4vulnerable
Ubuntulxdpro3.0.0~beta2-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta3-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta5-0ubuntu2vulnerable
Ubuntulxdpro3.0.0~beta7-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu2vulnerable
Ubuntulxdpro3.0.0-0ubuntu3vulnerable
Ubuntulxdpro3.0.0-0ubuntu4vulnerable
Ubuntulxdpro3.0.1-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.2-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm3fixed
Ubuntusnapdpro2.41+19.10.1vulnerable
Ubuntusnapdpro2.42.1+20.04vulnerable
Ubuntusnapdpro2.43.3+git1.8109f8vulnerable
Ubuntusnapdpro2.44~pre1+20.04vulnerable
Ubuntusnapdpro2.44+20.04vulnerable
Ubuntusnapdpro2.44.2+20.04vulnerable
Ubuntusnapdpro2.44.3+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04.2vulnerable
Ubuntusnapdpro2.46.1+20.04vulnerable
Ubuntusnapdpro2.47.1+20.04vulnerable
Ubuntusnapdpro2.48+20.04vulnerable
Ubuntusnapdpro2.48.3+20.04vulnerable
Ubuntusnapdpro2.49.2+20.04vulnerable
Ubuntusnapdpro2.51.1+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.2+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.3+20.04vulnerable
Ubuntusnapdpro2.54.3+20.04.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.2vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.3vulnerable
Ubuntusnapdpro2.55.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.58+20.04vulnerable
Ubuntusnapdpro2.58+20.04.1vulnerable
Ubuntusnapdpro2.61.3+20.04vulnerable
Ubuntusnapdpro2.62+20.04vulnerable
Ubuntusnapdpro2.63+20.04vulnerable
Ubuntusnapdpro2.63+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.65.3+20.04vulnerable
Ubuntusnapdpro2.66.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm1vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm3vulnerable
Ubuntusnapd22.042.53+21.10ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu2vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu3vulnerable
Ubuntusnapd22.042.54.3+git19.g868fc21+22.04vulnerable
Ubuntusnapd22.042.54.3+git26.g360067e+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04.1vulnerable
Ubuntusnapd22.042.55.3+22.04vulnerable
Ubuntusnapd22.042.55.3+22.04ubuntu1vulnerable
Ubuntusnapd22.042.55.5+22.04vulnerable
Ubuntusnapd22.042.56.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.57.4+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.58+22.04vulnerable
Ubuntusnapd22.042.58+22.04.1vulnerable
Ubuntusnapd22.042.61.3+22.04vulnerable
Ubuntusnapd22.042.62+22.04vulnerable
Ubuntusnapd22.042.63+22.04vulnerable
Ubuntusnapd22.042.63+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.65.3+22.04vulnerable
Ubuntusnapd22.042.66.1+22.04vulnerable
Ubuntusnapd22.042.67.1+22.04vulnerable
Ubuntusnapd22.042.68.5+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.71+ubuntu22.04vulnerable
Ubuntusnapd22.042.72+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.74.1+ubuntu22.04.4vulnerable
Ubuntusnapd22.042.75.2+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.77.1+ubuntu22.04.1vulnerable
Ubuntusnapd24.042.60.4+23.10vulnerable
Ubuntusnapd24.042.61.3+24.04vulnerable
Ubuntusnapd24.042.62+24.04build1vulnerable
Ubuntusnapd24.042.63+24.04vulnerable
Ubuntusnapd24.042.63+24.04ubuntu0.1vulnerable
Ubuntusnapd24.042.63.1+24.04vulnerable
Ubuntusnapd24.042.65.3+24.04vulnerable
Ubuntusnapd24.042.66.1+24.04vulnerable
Ubuntusnapd24.042.67.1+24.04vulnerable
Ubuntusnapd24.042.68.5+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.71+ubuntu24.04vulnerable
Ubuntusnapd24.042.72+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.2vulnerable
Ubuntusnapd24.042.74.1+ubuntu24.04.4vulnerable
Ubuntusnapd24.042.75.2+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.76.3+ubuntu24.04vulnerable
Ubuntusnapd24.042.77.1+ubuntu24.04vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1ubuntu0.1vulnerable
Ubuntusnapd25.102.67.1+25.04vulnerable
Ubuntusnapd25.102.68.5+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.71+ubuntu25.10vulnerable
Ubuntusnapd25.102.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.72+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.73+ubuntu25.10vulnerable
Ubuntusnapd25.102.73+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.74.1+ubuntu25.10.4vulnerable
Ubuntusnapd25.102.75.2+ubuntu25.10vulnerable
Ubuntusnapd26.102.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.1vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.2vulnerable
Ubuntusnapd26.102.76.3+ubuntu26.10vulnerable
Ubuntusnapd26.102.77.1+ubuntu26.10.1vulnerable
Ubuntusnapd26.042.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd26.042.72+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.73+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.74+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.042.75.2+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.76.3+ubuntu26.04vulnerable
Ubuntusnapd26.042.77.1+ubuntu26.04.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-go.cryptosourcesid1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourceforky1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcetrixie(unfixed)not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcebookworm(unfixed)not yet assignedNot reported[1137516]
CpecryptocpeNot reported0.52.0Not reportedNot reportedNot reported
Gogolang.org/x/cryptoGoNot reported0.52.0Not reportedGHSA-JPPX-RXG9-JMRXNot reported
Ubuntugolang-go.cryptodebpro1:0.47.0-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-39833Not reported
Ubuntulxddebpro3.0.3-0ubuntu1~18.04.2+esm3Not reportedUBUNTU-CVE-2026-39833Not reported

[Debian bug #1137516]

Notes

[trixie] golang-go.crypto: Minor issue [bookworm] golang-go.crypto: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-golang-x-crypto-dev]Affected

    Source package: [golang-go.crypto]

    Details (4)

    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

[Debian 13 (Trixie)]

  • [golang-golang-x-crypto-dev]Affected

    Source package: [golang-go.crypto]

    Details (4)

    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]