CVE-2026-42508

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Overview

State: PUBLISHED
Assigner (CNA): Go
CVSS severity: critical
CVSS score: 9.1 / 10
CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Effective score: 9.1 / 10 CRITICAL source: CNA overview
MSRC score: 9.1 / 10 CRITICAL MS rating: Important
CWE(s): CWE-295: Improper Certificate Validation
Reserved: 2026-04-28
Published: 2026-05-22 02:31 UTC
Last updated: 2026-05-22 18:44 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42508.json
Linked Threat: CVE-2026-42508 — CVE-2026-42508

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-22 04:16:25 UTC
NVD last modified: 2026-05-22 04:16:25 UTC
EPSS score: 0.0003 (probability of exploitation in next 30 days)
EPSS percentile: 8.85% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-31399
Assigner: Go
Published: May 22, 2026, 2:31:27 AM
Updated: May 22, 2026, 6:44:33 PM
EUVD base score (CVSS 3.1): 9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0400
Vendors: golang.org/x/crypto
Products: golang.org/x/crypto/ssh/knownhosts (0 <0.52.0)

ENISA description: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

EUVD references (4)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-11-03 04:06 UTC (source: CVRF).

MS severity: Important
MS CVSS base score: 9.1 / 10 (temporal 8.3)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U
Release: 2026-May

Microsoft remediations / KB articles (2)

CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 1.9.5-14)
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases

Affected products (1)

Vendor	Product	Versions	Platforms
golang.org/x/crypto	golang.org/x/crypto/ssh/knownhosts	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (9)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
MSRC update guide: CVE-2026-42508 msrc
https://www.first.org/epss/ tenable:www.first.org
https://groups.google.com/g/golang-announce/c/a082jnz-LvI tenable:groups.google.com
https://go.dev/issue/79568 tenable:go.dev
https://nvd.nist.gov/vuln/detail/CVE-2026-42508 tenable:nvd.nist.gov
https://pkg.go.dev/vuln/GO-2026-5021 tenable:pkg.go.dev
https://www.cve.org/CVERecord?id=CVE-2026-42508 tenable:www.cve.org
https://go.dev/cl/781220 tenable:go.dev

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://go.dev/cl/781220 security@golang.org
https://go.dev/issue/79568 security@golang.org
https://groups.google.com/g/golang-announce/c/a082jnz-LvI security@golang.org
https://pkg.go.dev/vuln/GO-2026-5021 security@golang.org

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Advisory Bulletin 064 | Ubiquiti Community

web:community.ui.com

Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

2026-05-26 03:00 UTC
CVE Database Search & Remediation Guidance | CVEDatabase.com

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-05-26 03:00 UTC
CVE-2026-42508 : Improper Revocation Check in Go Programming Language ...

web:securityvulnerability.io

What is CVE-2026-42508 ? A flaw in the Go programming language allows for the improper management of revoked certificates, specifically related to the checking of 'SignatureKey' revocations.

2026-05-26 03:00 UTC
CVE-2026-42508 - vulmon.com

web:vulmon.com

Recommendations: remote SSTI simple hierarchical select (shs) elevation of privilege term reference tree CVE - 2026 -48243 CVE - 2026 -42897 tickets CVE - 2026 -39833 CVE - 2026 -48246 CVE - 2026 -42945 CVE - 2026 -3481 jjnapiork Home / Search Results / CVE-2026-42508 Vulnerability Notification Service You don't have to wait for vulnerability scanning results ...

2026-05-26 03:00 UTC
Critical Patches Issued for Microsoft Products, May 12, 2026

web:www.cisecurity.org

<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

2026-05-26 03:00 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

2026-05-26 03:00 UTC
National Vulnerability Database | NIST

web:www.nist.gov

NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.

2026-05-26 03:00 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-26 03:00 UTC
CVE-2026-42508: revocation check vulnerability in crypto (Go)

web:www.resolvedsecurity.com

What is CVE-2026-42508 About? This vulnerability concerns an incomplete revocation check for `SignatureKey` belonging to a Certificate Authority (CA). Previously, only the primary `key` was checked, allowing revoked `SignatureKey`s to remain valid, leading to potential authentication bypasses.

2026-05-26 03:00 UTC
Oracle Patches 450 Vulnerabilities With April 2026 CPU

web:www.securityweek.com

Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.

2026-05-26 03:00 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42508.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T18:43:40.584666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T18:44:33.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh/knownhosts",
          "product": "golang.org/x/crypto/ssh/knownhosts",
          "programRoutines": [
            {
              "name": "hostKeyDB.IsRevoked"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.52.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T02:31:27.644Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79568"
        },
        {
          "url": "https://go.dev/cl/781220"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5021"
        }
      ],
      "title": "Invoking  auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42508",
    "datePublished": "2026-05-22T02:31:27.644Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-05-22T18:44:33.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}