x-crypto up to 0.51.x RSA/DSA inefficient cpu computation

Summaryinfo

A vulnerability was found in x-crypto up to 0.51.x. It has been classified as problematic. This affects an unknown part of the component RSA/DSA. This manipulation causes inefficient cpu computation. This vulnerability is registered as CVE-2026-39829. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in x-crypto up to 0.51.x and classified as problematic. Affected by this vulnerability is an unknown code block of the component RSA/DSA. The manipulation with an unknown input leads to a inefficient cpu computation vulnerability. The CWE definition for the vulnerability is CWE-1176. The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further. As an impact it is known to affect availability. The summary by CVE is:

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

The advisory is shared at go.dev. This vulnerability is known as CVE-2026-39829 since 04/07/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 316561 (Linux Distros Unpatched Vulnerability : CVE-2026-39829), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.52.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (316561), EUVD (EUVD-2026-31396) and CERT Bund (WID-SEC-2026-1653). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• IBM MQ
• Golang Go
• SUSE openSUSE
• Red Hat OpenShift

Productinfo

Name

• x-crypto

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion