Is CVE-2026-42508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42508 being exploited in the wild.

How severe is CVE-2026-42508?

Critical severity, with a CVSS score of 9.1, published 22 May 2026.

Which products and versions are affected?

golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.52.0; golang.org/x/crypto/ssh/knownhosts (Go) < 0.52.0; x/crypto/ssh/knownhosts (Go) before v0.52.0; Go Project Crypto/Ssh/Knownhosts < 0.52.0.

Is there a fix for CVE-2026-42508?

Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42508 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42508?

Check whether you run golang.org/x/crypto (Go), golang.org/x/crypto/ssh/knownhosts (Go), x/crypto/ssh/knownhosts (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42508: Go x/crypto/ssh/knownhosts failure to enforce revocation status

Q: Is there a fix for CVE-2026-42508?

Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42508 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42508?

Check whether you run golang.org/x/crypto (Go), golang.org/x/crypto/ssh/knownhosts (Go), x/crypto/ssh/knownhosts (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42508 · Severity: critical · CVSS 9.1 · Published 2026-05-22

A security issue was identified in a Go library used for managing SSH known hosts files. The library failed to properly check if a Certificate Authority (CA) signature key had been revoked, potentially allowing unauthorized users to bypass authentication. This could lead to unauthorized access to systems or data that rely on this library for SSH connection security.

Technologies: golang.org/x/crypto (Go). Vendors: Go, Go Project.

Quick answers

Is CVE-2026-42508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42508 being exploited in the wild.
How severe is CVE-2026-42508?: Critical severity, with a CVSS score of 9.1, published 22 May 2026.
Which products and versions are affected?: golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.52.0; golang.org/x/crypto/ssh/knownhosts (Go) < 0.52.0; x/crypto/ssh/knownhosts (Go) before v0.52.0; Go Project Crypto/Ssh/Knownhosts < 0.52.0.
Is there a fix for CVE-2026-42508?: Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42508 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42508?: Check whether you run golang.org/x/crypto (Go), golang.org/x/crypto/ssh/knownhosts (Go), x/crypto/ssh/knownhosts (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/crypto (Go): upgrade to 0.52.0 or later
```
go get golang.org/x/crypto@v0.52.0
```

Technical details

A vulnerability in the golang.org/x/crypto/ssh/knownhosts package (specifically within the hostKeyDB.IsRevoked function) allows for authentication bypass. The library previously failed to check the revocation status of a 'SignatureKey' belonging to a Certificate Authority (CA) when processing known_hosts files. An attacker could potentially use a revoked key to successfully authenticate if the library does not recognize the @revoked marker for the CA's signature key. The issue is fixed in version 0.52.0 by ensuring both the key and the key.SignatureKey are validated against the revoked list.

Affected products

Go Project golang.org/x/crypto/ssh/knownhosts < 0.52.0

Identifiers

CVE-2026-42508
GHSA-5cgq-3rg8-m6cv
GO-2026-5021

Timeline

2026-05-22: disclosed: NVD published date
2026-06-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.