Skip to content

fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [pipelines-1.20]#2908

Open
divyansh42 wants to merge 1 commit into
release-v0.42.2from
fix/SRVKP-12453-SRVKP-12457-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.42.2-attempt-1
Open

fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [pipelines-1.20]#2908
divyansh42 wants to merge 1 commit into
release-v0.42.2from
fix/SRVKP-12453-SRVKP-12457-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.42.2-attempt-1

Conversation

@divyansh42

@divyansh42 divyansh42 commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

CVE Details

CVE Severity Description Fixed Version
CVE-2026-39828 (GO-2026-5014) High Unauthorized command execution via discarded SSH permissions in golang.org/x/crypto/ssh v0.52.0
CVE-2026-39829 (GO-2026-5018) High DoS via crafted public key with excessive parameters in golang.org/x/crypto/ssh v0.52.0
CVE-2026-39830 (GO-2026-5017) High DoS via resource leak from unsolicited SSH responses in golang.org/x/crypto/ssh v0.52.0

Jira: SRVKP-12453, SRVKP-12457, SRVKP-12480

Fix Summary

  • Updated golang.org/x/crypto from v0.47.0 → v0.52.0
  • This version resolves all three CVEs (CVE-2026-39828, CVE-2026-39829, CVE-2026-39830)

Test Results ✅

Command: go test -mod=vendor -count=1 ./...
Status: PASSED

Breaking Changes

No breaking changes. Indirect dependency bump only.

Verification Steps

  • Review go.mod and go.sum for golang.org/x/crypto v0.52.0
  • Confirm CI passes
  • Merge after CI green

Risk Assessment

Low — Indirect dependency bump, no CLI API changes, all tests pass.

Updated by CVE Fixer automation — added CVE-2026-39830 (SRVKP-12480) coverage.

fix(cve): CVE-2026-39828, CVE-2026-39829 - golang.org/x/crypto/ssh
13615e0 
- Update golang.org/x/crypto from v0.47.0 to v0.52.0
- Addresses CVE-2026-39828: Unauthorized command execution via discarded
  SSH permissions in golang.org/x/crypto/ssh (GO-2026-5014)
- Addresses CVE-2026-39829: DoS via crafted public key with excessive
  parameters in golang.org/x/crypto/ssh (GO-2026-5018)
- Also picks up fixes for related x/crypto/ssh vulnerabilities in v0.52.0
- Run go mod tidy, go mod verify, go mod vendor; all tests pass

Resolves: SRVKP-12453, SRVKP-12457

Co-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@tekton-robot

tekton-robot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

@divyansh42: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot tekton-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Jun 18, 2026
@linux-foundation-easycla

linux-foundation-easycla Bot commented Jun 18, 2026

Copy link
Copy Markdown

CLA Missing ID

  • ❌ The email address for the commit (13615e0) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

@tekton-robot

tekton-robot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign piyush-garg after the PR has been reviewed.
You can assign the PR to them by writing /assign @piyush-garg in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 18, 2026
@divyansh42 divyansh42 changed the title fix(cve): CVE-2026-39828, CVE-2026-39829 - update golang.org/x/crypto to v0.52.0 [pipelines-1.20] fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [pipelines-1.20] Jun 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@piyush-garg piyush-garg Awaiting requested review from piyush-garg

@pradeepitm12 pradeepitm12 Awaiting requested review from pradeepitm12

@pratap0007 pratap0007 Awaiting requested review from pratap0007

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@divyansh42 @tekton-robot