CVE-2026-46598: Golang Crypto Input Parsing Vulnerability

CVE-2026-46598 Overview

CVE-2026-46598 affects the Go golang.org/x/crypto module's ed25519 implementation. The vulnerability allows an attacker to trigger a runtime panic by supplying crafted wire bytes that are cast into an ed25519.PrivateKey. When the malformed key is later used for signing or verification, the process panics, resulting in a denial of service. The flaw is network-reachable, requires no authentication, and stems from improper validation of array index input [CWE-129]. Applications that accept untrusted serialized Ed25519 key material — such as TLS libraries, SSH services, or PKI tooling built on Go — are exposed.

Critical Impact

Remote attackers can crash Go applications that deserialize attacker-controlled Ed25519 private key bytes, causing service disruption without authentication.

Affected Products

• golang.org/x/crypto (Go crypto supplementary module)
• Go applications consuming ed25519.PrivateKey from untrusted wire input
• Downstream libraries linking the vulnerable crypto package version

Discovery Timeline

• 2026-05-22 - CVE-2026-46598 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46598

Vulnerability Analysis

The vulnerability resides in the Ed25519 private key handling logic within golang.org/x/crypto. The code path constructs an ed25519.PrivateKey value by directly casting incoming wire bytes into the key type rather than validating length and structure first. Ed25519 private keys have a fixed 64-byte layout containing the seed and the derived public key suffix. When malformed input violates that expected layout, downstream operations index beyond the underlying slice and trigger a runtime panic.

The issue is categorized under [CWE-129] Improper Validation of Array Index. The impact is limited to availability — the bug does not leak key material or permit code execution. However, an unrecovered panic in a network service typically terminates the goroutine and, depending on the host application, may crash the entire process.

Root Cause

The root cause is missing length and shape validation before casting raw bytes to ed25519.PrivateKey. Go permits a direct type conversion from []byte to the named slice type, but the crypto routines assume the slice contains a well-formed 64-byte key. Crafted inputs that do not satisfy this invariant survive the cast and only fail later during cryptographic operations, where the failure manifests as an out-of-bounds access panic.

Attack Vector

An attacker delivers crafted bytes to any Go service that deserializes Ed25519 private key material from an untrusted source. Examples include configuration loaders, key import APIs, custom RPC protocols, and identity provisioning endpoints. The attacker does not need credentials or user interaction. Once the application calls Sign, Public, or comparable methods on the malformed key, the goroutine panics. Repeated requests sustain a denial-of-service condition.

No verified public proof-of-concept code is available. See the Go.dev Vulnerability Report and the Go.dev Issue Tracker Update for upstream technical details.

Detection Methods for CVE-2026-46598

Indicators of Compromise

• Unexpected process termination or goroutine panics in Go services that parse Ed25519 keys, with stack traces referencing ed25519 package functions.
• Repeated short-lived connections from the same source preceding a service crash or restart loop.
• Log entries containing runtime error: index out of range correlated with key import or signing operations.

Detection Strategies

• Inventory Go binaries and dependencies using govulncheck to identify modules linking vulnerable golang.org/x/crypto versions.
• Instrument applications to capture and log panics from cryptographic code paths rather than allowing silent crashes.
• Monitor service supervisors (systemd, Kubernetes) for elevated restart counts on workloads that process external key material.

Monitoring Recommendations

• Alert on crash loops and panic stack traces emitted by Go services exposed to untrusted input.
• Track ingress traffic patterns to endpoints that accept serialized keys for volumetric anomalies.
• Correlate application restarts with upstream request payloads in centralized logging to identify malicious input sources.

How to Mitigate CVE-2026-46598

Immediate Actions Required

• Update golang.org/x/crypto to the fixed release identified in the Go.dev Vulnerability Report and rebuild affected binaries.
• Run govulncheck ./... across Go repositories to enumerate call sites that reach the vulnerable Ed25519 code path.
• Restrict network exposure of services that accept Ed25519 key material from untrusted clients until patched.

Patch Information

The Go team published the fix through the upstream change list referenced in the Go.dev Cl Issue Advisory and announced it in the Google Groups Announcement. Upgrade the golang.org/x/crypto dependency to the patched version and redeploy. Container images and statically linked binaries must be rebuilt — module updates alone do not propagate to compiled artifacts.

Workarounds

• Validate the length of incoming key bytes equals 64 before casting to ed25519.PrivateKey, rejecting any other size at the application boundary.
• Wrap cryptographic operations on externally sourced keys in recover() blocks to contain panics within a request scope.
• Authenticate and rate-limit endpoints that accept serialized key material to reduce remote attack surface.

# Update the vulnerable module and verify with govulncheck
go get golang.org/x/crypto@latest
go mod tidy
govulncheck ./...