CVE-2026-46597: Golang Crypto

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Affected products

• Golang Crypto: before 0.52.0 (fixed in 0.52.0)

Published 2026-05-22. Last modified 2026-07-23.