CVE-2026-46597 Details
Description
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
A vulnerability in the AES-GCM packet decoder of the Go programming language's cryptography package can lead to a server-side panic. This issue arises from an incorrectly placed cast from bytes to int, which allows for well-crafted inputs to cause a panic on the server.
Users can update to version v0.52.0 of golang.org/x/crypto to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/781620 | [email protected] | Issue Tracking |
| https://go.dev/issue/79561 | [email protected] | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/a082jnz-LvI | [email protected] | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5013 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| golang crypto | < 0.52.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 22, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |