CVE-2026-46598: Golang Crypto

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Affected products

• Golang Crypto: before 0.52.0 (fixed in 0.52.0)

Published 2026-05-22. Last modified 2026-07-23.