high7.5
CVE-2026-46597
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Impact
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | golang.org/x/crypto | < 0.52.0 | 0.52.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Golang | Crypto | before 0.52.0 |