Fix CVE-2026-39834: bump golang.org/x/crypto to v0.52.0 - #442
Merged
Conversation
golang.org/x/crypto < v0.52.0 is vulnerable to an infinite loop in the ssh package on Write payloads larger than 4GB (CVE-2026-39834, Critical). This repo pins x/crypto via a replace directive, so bump the replace (and the transitively-required x/net/x/sys replaces that x/crypto v0.52.0 now demands) to v0.52.0/v0.54.0/v0.45.0 so require==replace==effective. Work item: AB#38721692 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4a902de7-e15e-494c-b590-1f9e94a5fadd
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
madhanrm
approved these changes
Jul 20, 2026
rjaini
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump
golang.org/x/cryptofrom thereplace-pinnedv0.37.0to v0.52.0 to remediate CVE-2026-39834 (Critical) — an infinite loop inx/crypto/sshon Write payloads > 4GB.Because
x/cryptois pinned via areplacedirective (which overridesrequireand is not inherited by downstream modules), the fix must be applied in this repo directly.x/crypto v0.52.0raises the module-graph minimums forx/net/x/sys, so theirreplacepins are aligned tov0.54.0/v0.45.0to keeprequire==replace==effective.Verification
go list -m golang.org/x/crypto->v0.52.0(effective)go mod tidyclean,go build ./...passesgo vetflags a malformed struct tag inpkg/config/config_test.go— not touched by this PR.Root of the MOC CG remediation chain
This is Step 1 (root
moc) of the multi-repo x/crypto remediation; downstream repos (moc-pkg, SDKs, agents, moccli) get their own x/cryptoreplacebumps.Work item: AB#38721692