golang.org/x/crypto/ssh/knownhosts vulnerabilities

1 known vulnerability in golang.org/x/crypto/ssh/knownhosts from Golang.org/x/crypto. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  golang.org/x/crypto/ssh/knownhosts: Improper Certificate Validation

  CVE-2026-42508May 22, 2026Golang.org/x/cryptoEPSS 6.91%

  Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.