CVE-2026-39833
A critical flaw in Go’s crypto library let keys with a ConfirmBeforeUse constraint sign data without prompting the user. This could allow an attacker to sign data or transactions without the user’s knowledge. The issue has been fixed in newer releases of the library.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The Go programming language’s crypto library (golang crypto) is affected. Developers and applications that use this library and rely on the ConfirmBeforeUse constraint are at risk.
Real-world impact
An attacker could sign data or transactions without the user’s consent, potentially enabling fraud or unauthorized actions.
Why this severity
The CVSS score of 9.1 reflects the high impact on confidentiality and integrity, the lack of authentication or user interaction required, and the ease of exploitation over the network.
What to do about it
- 01Upgrade golang crypto to the latest release that includes the fix.
NVD-referenced vendor advisory
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- go.dev/cl/778640issue tracking
- go.dev/cl/778641issue tracking
- go.dev/issue/79436issue tracking
- groups.google.com/g/golang-announce/c/a082jnz…mailing list
- pkg.go.dev/vuln/GO-2026-5005vendor advisory