etcd-io/etcd

Bump `golang.org/x/crypto@v0.52.0` to resolve several CVEs

Closed

#21,896 opened on Jun 3, 2026

View on GitHubContributor guide
 (4 comments) (0 reactions) (1 assignee)Go (10,352 forks)batch import
area/securityhelp wantedrelease/v3.5release/v3.6release/v3.7

Repository metrics

Stars
 (51,701 stars)
PR merge metrics
 (Avg merge 6d 3h) (71 merged PRs in 30d)

Description

https://prow.k8s.io/view/gs/kubernetes-ci-logs/logs/post-etcd-govulncheck/2062158046246735872

Vulnerability #1: GO-2026-5033
    Invoking pathological inputs can lead to client panic in
    golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2026-5033
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.51.0
    Fixed in: golang.org/x/crypto@v0.52.0
98 skipped lines...
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.51.0
    Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #15: GO-2026-5015
    Invoking server panic during CheckHostKey/Authenticate in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5015
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.51.0
    Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #16: GO-2026-5014
    Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5014
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.51.0
    Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #17: GO-2026-5013
    Invoking byte arithmetic causes underflow and panic in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5013
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.51.0
    Fixed in: golang.org/x/crypto@v0.52.0
15 skipped lines...

Contributor guide

Research direction
Update the go.mod file to replace the golang.org/x/crypto dependency with version v0.52.0, run go mod tidy to update the checksums, and verify that all tests pass.
Tech stack
go
Domain
databasebackend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90