)]}' { "log": [ { "commit": "3f62bf119e84c6e35e8518a2958089ade622d1a3", "tree": "49fee6e8ff0077ff732305ba31f4855da81a54a5", "parents": [ "86efde54dc7069251a8b007026c500d28e4239ce" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Sep 08 10:00:27 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Sep 08 11:05:01 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I39f495ef42016b2ab0c91f54b792ac16b967006f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/829324\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n" }, { "commit": "86efde54dc7069251a8b007026c500d28e4239ce", "tree": "79b1942707885af0952436981fa447db1923cb71", "parents": [ "a6cdac60840750226b15617ac8858be44361b36b" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sat Jun 13 11:48:20 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Sep 02 11:02:47 2026 -0700" }, "message": "ssh: reject unexpected message types on established channels\n\nch.msg is only read while the channel open or a channel request with a\nreply is pending, so anything the default arm of channel.handlePacket\ndelivered to it was never consumed. The blocking send there let a\nmisbehaving peer fill the buffer with well-formed but unexpected message\ntypes carrying a valid channel id and stall the mux read loop,\ndeadlocking the whole connection.\n\nNo conforming peer sends such messages during the connection protocol.\nTreat them as a protocol error and tear the connection down, as\nhandleUnknownChannelPacket already does for the same messages when the\nchannel id is not in use.\n\nFixes CVE-2026-56855\nFixes golang/go#81317\n\nChange-Id: I87420dfe68fcb62a17df4b47dc5ffb6ccd72ba26\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/826524\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "a6cdac60840750226b15617ac8858be44361b36b", "tree": "7c6031eb50eaff92a212cb61375c829897810e98", "parents": [ "39dc44e69c280a6254fa09ce85477455efeaf6a2" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sat Jun 13 11:54:07 2026 +0200" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Wed Sep 02 10:48:31 2026 -0700" }, "message": "ssh: drop traffic on undecided channels\n\nA channel in the mux\u0027s chanList is not usable until it is established:\nan outbound channel has no confirmed remote id until the peer\u0027s open\nconfirmation, and an inbound channel is not serviced by the application\nuntil it is accepted. handlePacket processed any channel message on it,\nso a misbehaving peer could flood channel requests and block the mux\nread loop on the send to incomingRequests, deadlocking the connection,\nor close an outbound channel before confirming it, making the victim\ntear down a half-initialized channel and emit a close for remote id 0,\nan unrelated channel of the peer.\n\nNo such packet can be legitimate: the peer learns an inbound channel\u0027s\nlocal id only from the confirmation we have not sent yet, and on an\noutbound channel RFC 4254 lets it answer the open request only with a\nconfirmation or a failure.\n\nAdd an established flag, set when the channel becomes usable: for an\noutbound channel when the open response is received, for an inbound\nchannel by Accept before the confirmation is sent. Until then\nhandlePacket drops every packet other than the open response. The flag\nis separate from decided, which Reject also sets: a rejected channel is\ndecided but must never carry traffic.\n\nFixes CVE-2026-78662\nFixes golang/go#81316\n\nChange-Id: Ib0983bb216a49808a2db1f4a4d92ee9fe38a3c51\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/826504\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "39dc44e69c280a6254fa09ce85477455efeaf6a2", "tree": "b8090bdd416e0e3b4385a472def9f4db670f028d", "parents": [ "afebf4cb4efb2b854282e03160da67120707f8f7" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Aug 18 10:22:35 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Sun Aug 30 20:04:51 2026 -0700" }, "message": "ssh: don\u0027t skip the source-address critical option in CheckCert\n\nCertChecker.CheckCert ignored source-address on the assumption that\nserverAuthenticate would enforce it, but that only happens in the\nserver-side user authentication path. Nothing enforced it in the host key\npath, so CheckHostKey accepted CA-signed host certificates carrying\nsource-address regardless of the server\u0027s address, and the same applied to\napplications calling CheckCert directly.\n\nDrop the special case: every critical option must be listed in\nSupportedCriticalOptions, host and user certificates alike. Authenticate,\nthe only path where serverAuthenticate does enforce source-address, checks\nagainst a copy of the CertChecker with that option appended.\n\nFixes golang/go#80872\n\nChange-Id: I3c3554b71ea2a4ce4b17696a9596b973b7d74b00\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/816840\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "afebf4cb4efb2b854282e03160da67120707f8f7", "tree": "ff7e46c92f5589eeaa4562aa60b35d63c5efd0a2", "parents": [ "89f4e9bb5b38861a69b1b26890a6833138d35ace" ], "author": { "name": "Dmitri Shuralyov", "email": "dmitshur@golang.org", "time": "Fri May 08 11:37:29 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Aug 26 07:40:58 2026 -0700" }, "message": "x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+\n\nThis gradual step towards removing/inlining subjectsEqual can happen\nafter Go 1.27.0 is released and the bundle starts being generated\nwith it.\n\nChange-Id: Ib315bae69c45922c3f0aac5d2c0155fb5d94229f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/775782\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n" }, { "commit": "89f4e9bb5b38861a69b1b26890a6833138d35ace", "tree": "8b52c4970646f9ebfdf81234630f453c83e49314", "parents": [ "71488c48c2dfecf900e52caa55f88ef4fef62d54" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Aug 24 16:01:08 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Aug 24 13:54:08 2026 -0700" }, "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I3be04cd4cb6e44856beaa074fdb62a58ff8ce35b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/820300\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "71488c48c2dfecf900e52caa55f88ef4fef62d54", "tree": "348dc59b902d4157562f31067889674b9e0376b9", "parents": [ "82adefa711cb8d9a1f12c7ea91b491007d21819f" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Aug 18 10:23:25 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Aug 23 06:53:19 2026 -0700" }, "message": "ssh/knownhosts: compare only public key portions for revocation\n\nRevocation matching compared full marshaled key blobs, so a @revoked\nline containing a plain host key did not revoke a certificate\ncertifying that key: when the server presented such a certificate,\nIsRevoked only matched the whole certificate blob or the CA key, and\nverification succeeded even though the underlying host key was revoked.\n\nOpenSSH\u0027s check_key_not_revoked compares keys with sshkey_equal_public,\nwhich considers only the public portions and explicitly allows\ncomparisons between certificates and plain keys. Match that behavior by\nnormalizing both @revoked entries and lookups to the underlying public\nkey: for a certificate, the certified key rather than the certificate\nblob. This also makes a @revoked line containing a certificate revoke\nthe plain key it certifies\n\nChange-Id: I3029d59e68fb01f2340763e2eae25cac23c6193d\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/816841\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "82adefa711cb8d9a1f12c7ea91b491007d21819f", "tree": "ddf17e8cbca630e4a429fd8e6ae161dcc39fceab", "parents": [ "c757c9851f77c470645455f548046ae0ce87ef8d" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Tue Aug 18 13:38:51 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Aug 19 13:42:46 2026 -0700" }, "message": "ssh: synchronize unexpected response test\n\nWait for an ordered channel request after sending the unsolicited\nresponse flood. This ensures that the client mux has discarded the\nentire flood before SendRequest opens its response gate, avoiding\nconfusion between an in-flight unsolicited response and the expected\nreply.\n\nThis fixes TestChannelUnexpectedResponsesDiscarded from flaking, where\notherwise running 1000000 iterations of the test with GOMAXPROCS\u003d16\nproduced ~15 distinct failures of the form \"expected success reply\".\n\nChange-Id: Ic1125c1f44bd919a5cf32b889d331bbc94c06c25\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/817140\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "c757c9851f77c470645455f548046ae0ce87ef8d", "tree": "985e7aded502ef1cb088f96794d32409be58ab10", "parents": [ "593c81af8aa6582d85a7faaeb996396f63d712a9" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Aug 19 16:59:35 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Aug 19 10:16:24 2026 -0700" }, "message": "all: upgrade go directive to at least 1.26.0 [generated]\n\nBy now Go 1.27.0 has been released, and Go 1.25 is no longer supported\nper the Go Release Policy (see https://go.dev/doc/devel/release#policy).\n\nSee https://go.dev/doc/godebug#go-126 for GODEBUG setting changes\nrelevant to Go 1.26.\n\nFor golang/go#69095.\n\n[git-generate]\n(cd . \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n(cd x509roots/fallback \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n\nChange-Id: I54826e019edd4e12ad821915b1d102de719bfb31\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/817981\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n" }, { "commit": "593c81af8aa6582d85a7faaeb996396f63d712a9", "tree": "e70f76500f24bb8ce3fbde3eafe29d69596f06c2", "parents": [ "46efc8bc62822d876c840e17017ed7071da3087c" ], "author": { "name": "Damien Miller", "email": "djm@djm.net.au", "time": "Thu Aug 06 18:06:24 2026 +1000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Aug 17 08:34:06 2026 -0700" }, "message": "ssh: correctly ignore pre-banner lines\n\nReading the peer\u0027s benner in readVersion() was incorrectly counting\nlines sent by the server before the actual `SSH-2.0` banner against\nthe line limit for the banner itself.\n\nThis is incorrect per RFC 4253 section 4.2, where the limit of 255\ncharacters is written to apply only to the `SSH-` banner string\nitself.\n\nThis instead limits pre-banner lines to 255 characters each but\ninstead allows a maximum of 1024 lines.\n\nChange-Id: Ief014bb3413e26e8d2077d3eb204ceaea9dc9444\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/811320\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "46efc8bc62822d876c840e17017ed7071da3087c", "tree": "7db2688d5f605b1d11a91892f9cf1aa2b625b521", "parents": [ "e0a54fdc4bf890e11573ddd8c531dc2cdc6eac47" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Fri Aug 14 09:42:34 2026 -0400" }, "committer": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Mon Aug 17 08:22:44 2026 -0700" }, "message": "acme: add crypto.SignMessage test coverage\n\nThis commit updates the pre-existing TestJWSEncodeJSONCustom test to\nalso verify JWS signature production works with a crypto.MessageSigner.\n\nChange-Id: I5156cb4da9a7feee98340ff4fb75848da5827055\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/815480\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "e0a54fdc4bf890e11573ddd8c531dc2cdc6eac47", "tree": "c7b9f5b8ca32ce19ff05c4985b253b52a3adfe2d", "parents": [ "f44d03d253a1503e51b059ca880867c51d878242" ], "author": { "name": "Daniel Tang", "email": "tangrs@google.com", "time": "Fri Aug 14 13:30:58 2026 +1000" }, "committer": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Mon Aug 17 08:21:42 2026 -0700" }, "message": "acme: use crypto.SignMessage instead of calling (crypto.Signer).Sign\n\ncrypto.SignMessage allows using crypto.Signers that only usefully\nimplement SignMessage to be used for the ACME account key.\n\nThis would be useful for opening up integrations with opinionated\nremote signing APIs that don\u0027t support pre-hashing.\n\nFixes golang/go#80877\n\nChange-Id: I86bb76cf5865d3d2b8606a6dbd813cbb26447c86\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/815340\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Sean Liao \u003csean@liao.dev\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "f44d03d253a1503e51b059ca880867c51d878242", "tree": "d9dc09fa1c9ff439b9f13ea1471f4a31a8374291", "parents": [ "5ed494470b06afb7621b303b04e38366d5863942" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Aug 11 10:19:44 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Aug 11 10:56:31 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I6e7a078f1a8ffe71bace5615ad4fc03a12466985\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/813280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n" }, { "commit": "5ed494470b06afb7621b303b04e38366d5863942", "tree": "20112fc725a33a4019013c9750e5abbd11b67393", "parents": [ "b07833c067ec08648541694dc11e02b5ab6b956a" ], "author": { "name": "Julian Zhu", "email": "julian.oerv@isrc.iscas.ac.cn", "time": "Sat Jan 24 00:11:28 2026 +0800" }, "committer": { "name": "Julian Zhu", "email": "jz531210@gmail.com", "time": "Mon Aug 03 22:01:12 2026 -0700" }, "message": "crypto/internal/poly1305: provide optimised assembly for riscv64\n\ngoos: linux\ngoarch: riscv64\npkg: golang.org/x/crypto/internal/poly1305\n │ sum1305-old │ sum1305-new │\n │ sec/op │ sec/op vs base │\n64-4 195.9n ± 1% 144.8n ± 0% -26.07% (p\u003d0.000 n\u003d10)\n1K-4 1.853µ ± 0% 1.012µ ± 0% -45.39% (p\u003d0.000 n\u003d10)\n2M-4 3.627m ± 0% 1.880m ± 0% -48.17% (p\u003d0.000 n\u003d10)\n64Unaligned-4 196.4n ± 1% 174.7n ± 0% -11.05% (p\u003d0.000 n\u003d10)\n1KUnaligned-4 1.853µ ± 0% 1.491µ ± 0% -19.54% (p\u003d0.000 n\u003d10)\n2MUnaligned-4 3.643m ± 0% 2.850m ± 0% -21.78% (p\u003d0.000 n\u003d10)\nWrite64-4 126.85n ± 0% 77.40n ± 0% -38.98% (p\u003d0.000 n\u003d10)\nWrite1K-4 1784.5n ± 1% 937.2n ± 0% -47.48% (p\u003d0.000 n\u003d10)\nWrite2M-4 3.654m ± 2% 1.880m ± 0% -48.55% (p\u003d0.000 n\u003d10)\nWrite64Unaligned-4 125.7n ± 0% 107.5n ± 0% -14.48% (p\u003d0.000 n\u003d10)\nWrite1KUnaligned-4 1.782µ ± 0% 1.424µ ± 0% -20.09% (p\u003d0.000 n\u003d10)\nWrite2MUnaligned-4 3.637m ± 0% 2.850m ± 0% -21.64% (p\u003d0.000 n\u003d10)\ngeomean 10.14µ 6.925µ -31.68%\n\n │ sum1305-old │ sum1305-new-3 │\n │ B/s │ B/s vs base │\n64-4 311.7Mi ± 1% 421.5Mi ± 0% +35.25% (p\u003d0.000 n\u003d10)\n1K-4 527.0Mi ± 0% 965.0Mi ± 0% +83.10% (p\u003d0.000 n\u003d10)\n2M-4 551.4Mi ± 0% 1063.8Mi ± 0% +92.94% (p\u003d0.000 n\u003d10)\n64Unaligned-4 310.8Mi ± 1% 349.3Mi ± 0% +12.38% (p\u003d0.000 n\u003d10)\n1KUnaligned-4 526.9Mi ± 0% 654.9Mi ± 0% +24.30% (p\u003d0.000 n\u003d10)\n2MUnaligned-4 548.9Mi ± 0% 701.8Mi ± 0% +27.85% (p\u003d0.000 n\u003d10)\nWrite64-4 481.2Mi ± 0% 788.6Mi ± 0% +63.89% (p\u003d0.000 n\u003d10)\nWrite1K-4 547.2Mi ± 1% 1042.0Mi ± 0% +90.42% (p\u003d0.000 n\u003d10)\nWrite2M-4 547.4Mi ± 2% 1064.0Mi ± 0% +94.38% (p\u003d0.000 n\u003d10)\nWrite64Unaligned-4 485.5Mi ± 0% 567.7Mi ± 0% +16.94% (p\u003d0.000 n\u003d10)\nWrite1KUnaligned-4 547.9Mi ± 0% 685.8Mi ± 0% +25.17% (p\u003d0.000 n\u003d10)\nWrite2MUnaligned-4 550.0Mi ± 0% 701.9Mi ± 0% +27.62% (p\u003d0.000 n\u003d10)\ngeomean 485.5Mi 710.7Mi +46.37%\n\nChange-Id: I33a3df03382eb42ef062b0366521f02559290482\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/738760\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Meng Zhuo \u003cmengzhuo1203@gmail.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\n" }, { "commit": "b07833c067ec08648541694dc11e02b5ab6b956a", "tree": "6153ea2367fae8e7bcfdb170697227716355660d", "parents": [ "d701c51f7e4e57f61c4947390514fe631e06202f" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 19 20:28:02 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Aug 03 14:00:09 2026 -0700" }, "message": "ssh: return window credit for discarded extended data\n\nhandleData subtracts the length of every data packet from the receive\nwindow, but extended data with a type code other than\nSSH2_EXTENDED_DATA_STDERR is then silently discarded and, since no API\nexists to read it, its window credit was never returned: adjustWindow\nonly runs as a side effect of reading a stream. A peer sending\nextended data with an unknown type code could therefore permanently\nshrink the channel window, down to a complete stall of the channel.\n\nCredit the discarded bytes back through adjustWindow. adjustWindow\nreturns io.EOF if the local side has already sent a channel close;\nignore it like ReadExtended does, since an error returned here would\nterminate the mux read loop and tear down the whole connection. For\ncomparison, OpenSSH rejects extended data with unexpected type codes\noutright and never buffers it, so the dropped bytes are simply never\ncredited back to the misbehaving peer.\n\nFixes golang/go#80333\n\nChange-Id: Ia311ce3ad008e7c89ce9752f1937c91374a4e74f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802901\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n" }, { "commit": "d701c51f7e4e57f61c4947390514fe631e06202f", "tree": "ab65509e552011e55050829d0438ac0ebdb2a190", "parents": [ "999d053994c9f2ececb2e85ab0bec72283539e33" ], "author": { "name": "Brad Fitzpatrick", "email": "bradfitz@golang.org", "time": "Mon Jul 20 18:10:27 2026 +0000" }, "committer": { "name": "Brad Fitzpatrick", "email": "bradfitz@golang.org", "time": "Thu Jul 23 08:25:44 2026 -0700" }, "message": "acme: fix nil pointer dereference in pebble test error reporting\n\nThe WaitOrder failure path used errors.Is with a nil *OrderError\ntarget, which never matches and left orderErr nil at the point its\nProblem field was dereferenced. Use errors.As to populate the target\ninstead.\n\nFound by govet\u0027s nilness check.\n\nChange-Id: Ieef849fcbf04c85ef32651059db2b5fe162af325\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803181\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "999d053994c9f2ececb2e85ab0bec72283539e33", "tree": "6aeba75df1f91a8a5b6bc44376906950bc448ab3", "parents": [ "90f76b8ffe1453c472892d338785687e9727bcc0" ], "author": { "name": "Brad Fitzpatrick", "email": "bradfitz@golang.org", "time": "Mon Jul 20 18:10:20 2026 +0000" }, "committer": { "name": "Brad Fitzpatrick", "email": "bradfitz@golang.org", "time": "Thu Jul 23 08:19:57 2026 -0700" }, "message": "ssh: fix parsing of GSSAPI payloads offering multiple mechanisms\n\nparseGSSAPIPayload overwrote the remaining payload with the trailing\nbytes returned by asn1.Unmarshal after decoding each OID, so any\nrequest offering more than one mechanism failed to parse after the\nfirst one. Track the remaining payload across iterations instead, and\nbe strict: reject payloads with trailing bytes after an OID or after\nthe mechanism list.\n\nAdd a test with a two-mechanism payload (Kerberos V5 followed by\nSPNEGO) that failed before this change.\n\nChange-Id: If0984efcf103da76323d5d03ad7443d8ec9d3aed\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803180\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "90f76b8ffe1453c472892d338785687e9727bcc0", "tree": "90c9d5974f4a63e764bf3eccf89dfd98cc08526b", "parents": [ "b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 19 21:07:53 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Jul 22 10:37:06 2026 -0700" }, "message": "ssh: reject certificate signature keys before recursing\n\nparseCert parsed a certificate\u0027s SignatureKey by calling ParsePublicKey\nagain, and only afterwards rejected a certificate used as a signing key.\nFor a chain of nested certificates this recursed once per level, so a key\nwith enough nesting exhausted the goroutine stack and crashed with a fatal\nstack overflow that recover cannot catch.\n\nReject the signature key by its declared algorithm before parsing it, which\nbounds parsing.\n\nFixes golang/go#80414\n\nChange-Id: Id51401aae15bfbec006c03ab97635a3b68bd6058\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802145\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8", "tree": "50c5378e307aa890cbb16d78c910f7bfe2c168c8", "parents": [ "626e40fc986f72b464ecb2063e02e7923bf3025d" ], "author": { "name": "database64128", "email": "free122448@hotmail.com", "time": "Mon Jul 13 20:04:08 2026 +0800" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Jul 22 10:37:01 2026 -0700" }, "message": "ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs\n\nThe documentation of ClientConfig.HostKeyAlgorithms says:\n\n If empty, a reasonable default is used.\n\nHowever, if HostKeyAlgorithms is empty but non-nil, the reasonable\ndefault won\u0027t be applied, and the SSH handshake will fail. Fix this by\nchanging the nil check to a length check.\n\nWhile here, do the same for KeyExchanges, Ciphers, MACs in Config.\n\nChange-Id: I1b3d2d2159f3c7d57a9a690ad04f1f6818b39a5c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/800080\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "626e40fc986f72b464ecb2063e02e7923bf3025d", "tree": "aec4de2e130558ee3a43335ee2911cd5c56894cc", "parents": [ "31914c699bfcc4906a7f6a178e910388518ed6a3" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 19 20:08:16 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed Jul 22 10:34:36 2026 -0700" }, "message": "ssh: drain stderr on forwarded TCP and Unix channels\n\ntcpListener.Accept, unixListener.Accept, Client.dial and\nClient.dialStreamLocal only read the main stream of the channels they\nreturn. Data sent by the peer on the extended (stderr) stream\naccumulates in the extPending buffer and its window credit is only\nreturned by ReadExtended, which is never called. Since the window is\nshared between the two streams, a misbehaving peer can pin up to 2 MiB\nper channel and eventually stall it; well-behaved peers never send\nstderr on these channel types.\n\nDrain the stderr stream into io.Discard, mirroring CL 783720 which\nfixed the same issue in the agent forwarders.\n\nThe drain takes precedence over reading Stderr through a type assertion\non the returned net.Conn, which was never a supported use. For\ncomparison, OpenSSH refuses extended data on these channel types and\ndrops the payload without buffering it.\n\nUpdates golang/go#80333\n\nChange-Id: I4f1445eee9ce1b56ca62cec342812d63cfdd3e13\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802900\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "31914c699bfcc4906a7f6a178e910388518ed6a3", "tree": "a421a7598f42da69392d47395d9d83fe695761e1", "parents": [ "f2135b814ca127b11d04d6d6f0e6569922bace0f" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jul 20 16:01:05 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jul 21 14:38:23 2026 -0700" }, "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: Ic89f2ab75500d9b03a76236f2228657508a4d16d\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803060\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "f2135b814ca127b11d04d6d6f0e6569922bace0f", "tree": "cd52174eeb31eea72752e41ed15a6de6995e2e04", "parents": [ "ff03dafdb03eafe35dd29a219550a907489a7a69" ], "author": { "name": "Brad Fitzpatrick", "email": "bradfitz@golang.org", "time": "Mon Jul 20 18:10:38 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jul 21 14:30:59 2026 -0700" }, "message": "all: clean up minor issues found by staticcheck\n\nUse bytes.Equal instead of comparing bytes.Compare results to zero,\navoid Yoda conditions, drop a redundant zero slice capacity, use\nstrings.ReplaceAll, build acme error strings with a strings.Builder,\nand lowercase an error string in ocsp. No behavior changes.\n\nChange-Id: I5d2b3fa5c241adc75e61be0f2d2d7af1eb9e8d66\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803200\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "ff03dafdb03eafe35dd29a219550a907489a7a69", "tree": "8a8112d4608e920dcec99ced4e7c979ecf557761", "parents": [ "10b54ffa51b134f7100e147742e5fc7d8d818a11" ], "author": { "name": "Akira", "email": "50253469+Daquisu@users.noreply.github.com", "time": "Wed Jul 15 00:46:40 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Fri Jul 17 15:41:46 2026 -0700" }, "message": "ssh: report verified signature format to callback\n\nVerifiedPublicKeyCallback currently receives the public-key algorithm\ndeclared in the outer authentication request. For RSA authentication,\nthat value can differ from the format of the signature that was\nsuccessfully verified because compatible RSA algorithm combinations are\naccepted.\n\nThis can cause post-verification policy or audit decisions to use the\nrequest algorithm instead of the signature format actually verified.\n\nPass sig.Format to VerifiedPublicKeyCallback so signatureAlgorithm\nidentifies the successfully verified signature format. Clarify the\ncallback documentation and add a regression test covering compatible\nbut different RSA request algorithms and signature formats.\n\nFixes golang/go#80411\n\nChange-Id: Ib405378d75367a90536e0814c9d26d4dec9aaa25\nGitHub-Last-Rev: 1a4acd4e639361be1f2948a4aef1013436a75ecf\nGitHub-Pull-Request: golang/crypto#364\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/800740\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nAuto-Submit: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "10b54ffa51b134f7100e147742e5fc7d8d818a11", "tree": "772649a97d7d87d288822056b16fda601db8da42", "parents": [ "0f039f3a4ad8093b3587dd32a675f6f101f902ed" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Jun 29 19:13:41 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Jul 13 20:33:21 2026 -0700" }, "message": "ssh: raise the RSA modulus limit to 16384 bits\n\nthe fix for CVE-2026-39829 capped the accepted RSA modulus at 8192 bits,\nmatching crypto/tls, to bound the CPU cost of verifying an\nattacker-supplied key. That rejected keys OpenSSH generates: ssh-keygen\nallows -b up to 16384. Raise the limit to 16384 so those keys interoperate,\nboth in the public key parser and the OpenSSH private key parser, and\ncorrespondingly raise the prime-factor bound to 8192 bits (each prime is\nabout half the modulus). The agent\u0027s checkRSAKeyParams is updated to match.\n\nVerifying a 16384-bit key costs roughly 3x an 8192-bit one.\n\nFixes golang/go#80075\n\nChange-Id: Ib08ddd7b48552e692c48dbdf105bbc8579120bbc\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795421\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "0f039f3a4ad8093b3587dd32a675f6f101f902ed", "tree": "7bbbc79ceef05bd1099ab79fa7c02774d356e311", "parents": [ "b27e1504e38fe3d716ce5e0043304791f99fb295" ], "author": { "name": "Nicholas S. Husin", "email": "nsh@golang.org", "time": "Wed Jul 08 12:15:26 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jul 13 12:23:17 2026 -0700" }, "message": "ssh: sanitize various error messages\n\nSimilar to CL 780180, sanitize other error messages that are controlled\nby the remote peer, to avoid potential injection of control characters.\n\nAlso remove sanitizeString usage as it is not strictly needed to escape\nerror messages safely, and for consistency with how we sanitize other\nerror messages throughout the codebase.\n\nBannerDisplayStderr is left unsanitized for now, as it is one instance\nwhere we might actually want control characters for valid reasons (see\ngolang/go#80302).\n\nUpdates golang/go#80302\nFixes golang/go#80301\n\nChange-Id: Ie40f4ac2f76afed740dceb548a4b0fa96a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798420\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "b27e1504e38fe3d716ce5e0043304791f99fb295", "tree": "da82f3ac3d063da2229ffa7877a06618f4882e3f", "parents": [ "c1a3b97d708a15b7b939b739ba276187844849a2" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Jun 29 18:53:37 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jul 13 12:20:29 2026 -0700" }, "message": "ssh: don\u0027t close the connection on an unparseable public key\n\nIn the server\u0027s publickey authentication path, a public key blob that\nParsePublicKey could not decode caused serverAuthenticate to return an\nerror, tearing down the whole connection. A key we cannot parse is part\nof an individual authentication attempt, not a transport-level framing\nerror, so it must fail only that attempt. This lets the client fall\nback to other keys or authentication methods.\n\nUpdates golang/go#80075\n\nChange-Id: I8d882d08bb50eb33e0054d9d9c2bd9e0b3039443\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795420\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "c1a3b97d708a15b7b939b739ba276187844849a2", "tree": "af0f0f075c505bd9555644a5f46a393435bb49e4", "parents": [ "b9229ecc70c7deaaeb07ce6c13427349d6d4ffcc" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 19:37:35 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:47 2026 -0700" }, "message": "ssh: document and test source-address behavior for non-IP transports\n\nThe source-address critical option is a comma-separated list of IP\naddresses and CIDR blocks, so it can never match a connection whose\nremote address is not IP-based, such as a Unix domain socket.\n\nChange-Id: I45e09fe5c8c13922cb0735278acf33320857322c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797042\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "b9229ecc70c7deaaeb07ce6c13427349d6d4ffcc", "tree": "23a7567e128a4a34cf881975698f815ce927d4b3", "parents": [ "e557b08ec2b4f5dd00f38356919fc7b051dd88f8" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 19:00:35 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:43 2026 -0700" }, "message": "ssh: reject a present but empty source-address critical option\n\ncheckSourceAddressCriticalOption treated a source-address critical\noption with an empty value as if the option was absent, allowing\nauthentication from any address. A callback (or certificate authority)\nbuilding the value dynamically from an empty allowlist would intend to\ndeny all sources, not to lift the restriction. This also contradicts\nthe documented contract that the option is validated whenever it is\npresent, and differs from OpenSSH, where an empty address list matches\nnothing.\n\nChange-Id: I1c0de27cbcab8817a7ff446019c25cd19957a7d7\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797041\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "e557b08ec2b4f5dd00f38356919fc7b051dd88f8", "tree": "9f9139f33e45b9ece10c070085807f5d3e56051e", "parents": [ "4044611da8b85cbd5eb55c657d59244ffb18d3e4" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 18:50:56 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:37 2026 -0700" }, "message": "ssh: enforce the source-address critical option for all auth callbacks\n\nCVE-2026-46595 extended source-address validation, historically applied\nonly to the Permissions returned by PublicKeyCallback, to the ones\nreturned by VerifiedPublicKeyCallback. The documented contract of\nPermissions.CriticalOptions does not restrict enforcement to a specific\nauthentication method, so move the check to a single point at the end of\neach authentication attempt, where it covers the Permissions returned by\nany callback (password, keyboard-interactive, none and GSSAPI included).\n\nThe check at public key cache insertion time is kept: it remains\nauthoritative for the Permissions returned by PublicKeyCallback, which\nVerifiedPublicKeyCallback may replace before the check at the end of the\nauthentication attempt runs and which are not re-checked on partial\nsuccess. It also still makes public key queries fail before the client\nproduces a signature when PublicKeyCallback supplies the restriction.\n\nFixes CVE-2026-56854\nFixes golang/go#80213\n\nChange-Id: Ibd612a8e4240bd710e33754f3ceb95bb29169d9a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797040\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "4044611da8b85cbd5eb55c657d59244ffb18d3e4", "tree": "148ec717f2aa2a695c6eb5caa34ee5c0a7b9a511", "parents": [ "e8ad5cb7aacc413e7071604faf8feb5e51eac000" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 20:14:11 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:29 2026 -0700" }, "message": "ssh: fix data race in the doClientServerAuth test helper\n\nThe helper returned the auth errors collected via AuthLogCallback\nwithout waiting for the server goroutine that appends to them. Close\nthe client side of the connection on handshake failure, to unblock a\nserver still reading from it, and join the server goroutine before\nreturning.\n\nChange-Id: Ibe8c3b236491769f3433f7457d4f2b9a07a65be0\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797043\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "e8ad5cb7aacc413e7071604faf8feb5e51eac000", "tree": "b16c7cc246efb725e95dc5b3af8b4f3086462945", "parents": [ "fe1af3a4189650f6a61d30bfcb431e61bb141f41" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 20:41:50 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:12 2026 -0700" }, "message": "ssh: initialize new channels fully before adding them to chanList\n\nnewChannel published the channel into the mux\u0027s chanList (via\nchanList.add) before assigning its localId, and openChannel/Accept set\nmaxIncomingPayload only after newChannel returned. For an outbound\nchannel, whose newChannel runs on an application goroutine, the mux\nloop could observe the channel through getChan before those fields\nwere initialized, reading a zero localId or maxIncomingPayload with no\nhappens-before relationship.\n\nAssign localId inside add while the chanList lock is held, and set\nmaxIncomingPayload (always channelMaxPacket) in newChannel itself, so\na channel returned by getChan is always fully initialized.\n\nChange-Id: Ib54a5d10dcb5c1ad8ed4dabe5d8d2790778be298\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797061\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "fe1af3a4189650f6a61d30bfcb431e61bb141f41", "tree": "395cff39cb044b4c7dfbe0da1889ebc5835d6b9d", "parents": [ "243e02a382f85bf94966b9c5c999f9ebae97df2e" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 05 20:20:39 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jul 12 08:19:06 2026 -0700" }, "message": "ssh: make channel.close idempotent\n\nchannel.close closes the internal Go channels (msg, incomingRequests);\ncalling it twice panics with \"close of closed channel\". Both current\ncallers run on the mux loop and are serialized, so the panic is not\nreachable today. Harden close by guarding it with sync.Once, so that\nthe connection does not become fragile to any future bug that reaches\nclose twice.\n\nChange-Id: I5d8d948367538ea5561724033c4ee4daa668e221\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797060\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "243e02a382f85bf94966b9c5c999f9ebae97df2e", "tree": "33f37a90e19bec0a1c27056a94ea2875f03ea292", "parents": [ "cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Wed Jul 08 10:12:08 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu Jul 09 11:40:58 2026 -0700" }, "message": "ocsp: update ParseRequest docs \u0026 error conditions\n\nParseRequest was documented as erroring for inputs that contained\nan optional request signature, and as only supporting requests for\na single certificate.\n\nHowever, prior to this commit DER inputs that contained a signature\nsucceeded without verifying the signature, and inputs that contained\nmultiple certificate identifiers succeeded but only the first\ncertificate identifier was unmarshalled.\n\nThis commit updates the function behaviour to return an error for the\nsignature case as described in the docs, and to clarify the\ndocumentation for inputs with multiple certificate identifiers.\n\nFixes golang/go#80300\n\nChange-Id: I7446422d6c98bd406b8c43e55fea9a16ace9d4a6\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798220\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62", "tree": "ef07d8c046727edc3a016ed95145cf47320e5417", "parents": [ "d9474cc4853d9ef1a29356975408d4771e5770c6" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Jul 08 09:21:34 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Jul 08 11:22:26 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I431b878ec8830bf1894ae19176b5984b00954557\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n" }, { "commit": "d9474cc4853d9ef1a29356975408d4771e5770c6", "tree": "ce72d849ffb2733aa530cacb0076e32dde50873b", "parents": [ "7626c5025624025bb44739a805f431cf93c06d6e" ], "author": { "name": "Roland Shoemaker", "email": "roland@golang.org", "time": "Wed Jun 24 17:41:52 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jul 07 10:06:58 2026 -0700" }, "message": "openpgp: make the deprecation message more explicit\n\nThe package is unmaintained, unsafe at any speed, and does not receive\nsecurity fixes. Document that, and point at the ProtonMail fork for\nthose that _must_ still use OpenPGP.\n\nChange-Id: Ia602eaaf9e08bd25389400ebe7f346b60bdb9d99\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/794200\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n" }, { "commit": "7626c5025624025bb44739a805f431cf93c06d6e", "tree": "e1efe0842f3ca782263b6d97b23f6b59b1fcf7fd", "parents": [ "0471e7969e6740594dfe354646bf03e5e89de52d" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu Jun 04 15:59:34 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jun 30 10:24:32 2026 -0700" }, "message": "ssh: verify declared key type matches decoded key in authorized_keys\n\nParseAuthorizedKey and ParseKnownHosts previously ignored the key type\nfield (e.g. \"ssh-rsa\") in each entry, relying solely on the type\ninformation embedded within the base64-encoded key blob.\n\nFor ParseAuthorizedKey this also caused a single-token option to be\nsilently dropped: a line such as \"restrict \u003ckey\u003e\" (with the key type\nomitted) was parsed as an unrestricted key, because the option token\nlanded in the key type position and was discarded together with its\nmeaning. The same happens for no-pty, no-port-forwarding and the other\nsingle-word options. OpenSSH\u0027s sshkey_read rejects such lines outright,\nas the option token cannot be read as a key type.\n\nOpenSSH\u0027s sshkey_read also explicitly verifies that the key type\ndeclared in the text matches the type of the parsed key, returning\nSSH_ERR_KEY_TYPE_MISMATCH if they differ.\n\nThis change adds, in both functions, a check that the declared key type\nmatches the decoded key\u0027s type, returning an error for malformed lines\nwhere they diverge. This mirrors the fix already applied to the\nssh/knownhosts package in CL 782427.\n\nChange-Id: I9163108d964de4be8a415fe0efd68e6b71f77990\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/792840\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "0471e7969e6740594dfe354646bf03e5e89de52d", "tree": "512c889fed163313aabd039c3f5fa1c60b2f0664", "parents": [ "6435c37ab681759aff37ba751d0f2238b3043767" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Jun 29 19:45:55 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 30 10:06:28 2026 -0700" }, "message": "ssh/agent: enforce strict limits on DSA key parameters\n\nThe parseDSAKey function constructed a *dsa.PrivateKey directly from the\nadd-identity request without validating the key parameters. Unlike DSA\ncertificates, whose parameters are checked by the ssh package when the\ncertificate\u0027s public key is parsed, raw DSA keys added to the agent were\nnot validated at all.\n\nAlign the raw DSA key parsing with the validation already performed by\nthe main ssh package.\n\nFixes golang/go#79725\n\nChange-Id: I537cc2175d35c19848c90c68739cf94ba7b50e10\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795422\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "6435c37ab681759aff37ba751d0f2238b3043767", "tree": "29c47a013ad4707ed5c46fd08e70c688cd1a9941", "parents": [ "7d695da948bfa44ed6eedcebc8f43bcb50e94a57" ], "author": { "name": "Neal Patel", "email": "neal@golang.org", "time": "Tue May 19 20:30:03 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jun 29 10:23:17 2026 -0700" }, "message": "ssh: sanitize client disconnect messages\n\nA malicious peer can send control characters\nand escape sequences in SSH_MSG_DISCONNECT;\nstrip these characters and %q escape it.\n\nChange-Id: I266f78630a7a816a79ce4dda568ce57d7c3f6fb0\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/780180\nCommit-Queue: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "7d695da948bfa44ed6eedcebc8f43bcb50e94a57", "tree": "e0b17c9253dd8db2e8ebe1a6ecc09f2529075a36", "parents": [ "5b7f84159940519e89df4d95465538c1797cee8b" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed May 27 11:59:43 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Jun 29 06:36:26 2026 -0700" }, "message": "ssh/agent: drain channel stderr in agent forwarders\n\nForwardToAgent and ForwardToRemote only read the main stream of the\nauth-agent@openssh.com channels they accept. If a peer sends data on\nthe channel\u0027s extended (stderr) stream the bytes accumulate in the\nclient-side extPending buffer and the receive window is never\nreplenished, because the window is only adjusted as a side effect of\nReadExtended. That can pin up to channelWindowSize (2 MiB) of memory\nper channel and silently stalls any stderr traffic once the window is\nexhausted.\n\nThe auth-agent protocol does not use stderr, so a well-behaved peer\nnever sends anything on it. To stay tolerant of misbehaving peers\nwithout leaving the channel half-stuck, drain the stderr stream into\nio.Discard, mirroring the existing DiscardRequests pattern. The\ngoroutine exits when the channel is closed because Stderr().Read\nreturns io.EOF.\n\nAdd a regression test that opens an agent-forwarding channel and\nwrites more than the default window on the stderr stream from the\nserver side. Without the fix the write blocks once the remote window\nis exhausted; with the fix the bytes are drained and the agent stream\nremains usable.\n\nChange-Id: Iadf8ea6ca726c058421bbc39f92e0100579fda17\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783720\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "5b7f84159940519e89df4d95465538c1797cee8b", "tree": "c7afebae1e8fd43cc05679550b7af9d8da1bef47", "parents": [ "0b316e7ee409f8e5789a0535679d34155cecc75e" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Wed Jun 24 11:30:04 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Fri Jun 26 08:59:20 2026 -0700" }, "message": "acme/autocert: fix data race in Manager.createCert\n\nPreviously Manager.createCert() read state.locked without holding any\nlock, while the owner goroutine wrote state.locked \u003d false under the\nstate\u0027s write lock. Concurrent goroutines for the same domain raced on\nthat field.\n\nWe fix the issue by removing the certState.locked field and instead\nhaving Manager.certState() return an additional owner bool computed\nunder the m.stateMu lock. This allows the Manager.createCert() caller to\nknow whether it must block on the read lock and return the state handled\nby another goroutine, or instead do the work itself and release the\nwrite lock.\n\nA regression unit test is included that fails under -race without the\nfix, and passes with the fix in-place.\n\nFixes golang/go#80119\n\nChange-Id: I0f4c5c98f7e6bcf1ab71a3c0707bb0c7ce73415b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/793840\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n" }, { "commit": "0b316e7ee409f8e5789a0535679d34155cecc75e", "tree": "9c137719c35f9a96036a6e55e9bb37f579b82d05", "parents": [ "55aec0a86b4c522b4f7366e69db55349e9f7ff5c" ], "author": { "name": "harjoth", "email": "harjoth.khara@gmail.com", "time": "Wed Jun 10 15:48:43 2026 +0000" }, "committer": { "name": "Roland Shoemaker", "email": "roland@golang.org", "time": "Thu Jun 18 09:22:19 2026 -0700" }, "message": "argon2: update RFC 9106 parameter recommendations\n\nUpdate the IDKey example to use RFC 9106\u0027s first recommended Argon2id\noption and clarify the relationship between the first and second\nrecommended options.\n\nFixes golang/go#79823\n\nChange-Id: If44a86a5a8112b02fab97b4d5e325fe91d6049ee\nGitHub-Last-Rev: a764ae65875f12d7422865c4e83f345a8a4f246e\nGitHub-Pull-Request: golang/crypto#357\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/789020\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "55aec0a86b4c522b4f7366e69db55349e9f7ff5c", "tree": "4264c6392a1d6f85f4e8aaa85583dfb582c11478", "parents": [ "5f2de1a9f1e29059fbb9f3d34321bd0da935556b" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jun 15 21:14:50 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jun 15 14:38:55 2026 -0700" }, "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I448f9962a67bf042b04a2e34f16ae02a004d6edd\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/791040\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "5f2de1a9f1e29059fbb9f3d34321bd0da935556b", "tree": "3de906699928fb58fb4d3fa68b9e29760478b01d", "parents": [ "45460e079737ecb64f30d79d3d6fc2914494fa66" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Mon Mar 23 16:24:22 2026 -0400" }, "committer": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Tue Jun 09 11:23:32 2026 -0700" }, "message": "internal: remove wycheproof tests\n\nEquivalent coverage using newer Wycheproof vectors has been added to the\nstandard library, alongside the implementations under test.\n\nIn the case where the algorithm doesn\u0027t exist in the stdlib, but is\nintended to be supported there one day (e.g. chacha20poly1305) we flip\nthe relationship and run the Wycheproof tests from the stdlib on the\nvendored /x/crypto. As a result the legacy Wycheproof coverage in this\nrepo can be removed.\n\nChange-Id: Ic07d559e42599b715906f5bcc39be10944a8dde4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/758420\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "45460e079737ecb64f30d79d3d6fc2914494fa66", "tree": "bef53260d466e2d7ce5f9a0cb0375e9a133ce04b", "parents": [ "d37c95e27de65576f42440cdfbc261d810506841" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jun 08 08:43:49 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Jun 08 08:52:49 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I1dc78ceffd32c80457b284aa1bcefb6dfc2757ba\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/788222\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n" }, { "commit": "d37c95e27de65576f42440cdfbc261d810506841", "tree": "ee7dd55b2956701227782d88bae503f9f247294b", "parents": [ "e2ffffe738fb46531cd8924bab497bdc77d9ecc8" ], "author": { "name": "mohammadmseet-hue", "email": "mohammadmseet@gmail.com", "time": "Mon Apr 06 20:10:40 2026 +0000" }, "committer": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Thu Jun 04 06:58:05 2026 -0700" }, "message": "pkcs12: limit PBKDF iteration count to prevent CPU exhaustion\n\nThe PKCS#12 PBKDF iteration count is read directly from\nthe input file with no upper bound. A crafted 83-byte .p12\nfile can set iterations to 2^31-1 (2147483647), causing\nDecode() to block a CPU core permanently.\n\nThis change adds a maximum iteration limit of 1000000 in\nboth verifyMac and pbDecrypterFor. Any file that specifies\nmore iterations than this cap is rejected with an error.\n\nFor reference, OpenSSL caps PBKDF2 at 10000000 iterations,\nand scrypt is bounded by its memory-hardness parameters.\nThe 1000000 limit is generous for legitimate PKCS#12 files\nwhile still preventing denial of service.\n\nFixes golang/go#78524\n\nChange-Id: I1d12d6f5d90e347ca0dc113678abc51b0cff8d85\nGitHub-Last-Rev: a0370d492dd4735cc7c1bb082b359ad79863fdae\nGitHub-Pull-Request: golang/crypto#343\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/759900\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e2ffffe738fb46531cd8924bab497bdc77d9ecc8", "tree": "b1c31ba161d1d87446d4d1fe3235d0b7acfe37a2", "parents": [ "60e158ad30c226555794539d96f0f104f43395f7" ], "author": { "name": "povcfe", "email": "povcfe2sec@gmail.com", "time": "Mon May 04 03:14:35 2026 +0000" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:25:39 2026 -0700" }, "message": "ssh: reject incomplete gssapi-with-mic configurations\n\nMake the runtime gssapi-with-mic guard match the existing\nconfiguration and method advertisement checks.\n\nAn incomplete GSSAPIWithMICConfig can be treated as unavailable when\nbuilding the advertised auth method list, while still remaining\nreachable from the runtime auth dispatcher. Treat incomplete\nconfigurations as not configured.\n\nThis change introduces a single internal completeness check for\nGSSAPIWithMICConfig and uses it for the startup authentication\nvalidation, the runtime gssapi-with-mic dispatch guard, and the\nadvertised authentication method list.\n\nThe change also adds a regression test. The test configures a server\nwith a normal PasswordCallback, a GSSAPIWithMICConfig with Server set,\nand AllowLogin intentionally unset. It then uses a custom client auth\nmethod that explicitly sends a USERAUTH_REQUEST with Method set to\ngssapi-with-mic even though the server does not advertise that method,\nand verifies that authentication fails cleanly with\n\"ssh: gssapi-with-mic auth not configured\".\n\nNo golang/go issue reference is available yet.\n\nChange-Id: I9a0c965d3a56192bd68309aa41e2c1f91952036c\nGitHub-Last-Rev: 0267bda8e15e7c258ba3b92cd54f0941534c5fc9\nGitHub-Pull-Request: golang/crypto#345\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/773460\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "60e158ad30c226555794539d96f0f104f43395f7", "tree": "dea9dc7b5181d09d932f9201fac609be638383e7", "parents": [ "1b77d23dc8afb26a494e331a3c637b6de88398d2" ], "author": { "name": "Mike Nolta", "email": "mike@nolta.net", "time": "Thu May 14 09:51:25 2026 -0400" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:25:33 2026 -0700" }, "message": "ssh/test: isolate CLI tests from user SSH config and agent\n\nPass -F none and -o IdentityAgent\u003dnone to ssh(1) invocations in the\nCLI tests. Without these flags, a user\u0027s ~/.ssh/config can enable\nControl{Master,Persist}, which causes the ssh process to fork a\nbackground daemon that holds stdout/stderr pipes open, preventing\nCombinedOutput from ever returning. The agent flag prevents keys loaded\nin the user\u0027s SSH agent from being offered to the server before the test\nkey, which would exhaust MaxAuthTries and cause a disconnect.\n\nFixes golang/go#79411\n\nChange-Id: Id5b073e6df661006183d000928d7ef6e6096b933\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/777900\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "1b77d23dc8afb26a494e331a3c637b6de88398d2", "tree": "5b4d77811464d2c1f7b2fbb77f21080a4b826df0", "parents": [ "3872a2bc69f464352dea49c2856955ef7c5d5851" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:56:18 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:24:36 2026 -0700" }, "message": "ssh/knownhosts: reject lines with multiple or unknown markers\n\nPreviously, parseLine would accept lines with multiple markers (e.g.,\n\"@cert-authority @revoked ...\") or unknown markers (e.g., \"@unknown ...\").\nIn these cases, the second or unknown marker was incorrectly parsed as\nthe hostname. This often resulted in confusing downstream errors (like\n\"illegal base64 data\") because field positions were shifted.\n\nOpenSSH\u0027s hostfile.c strictly enforces a limit of one marker per line\nand validates that markers must be exactly \"@cert-authority\" or\n\"@revoked\".\n\nThis change adds a check to ensure that the parsed hostname does not\nstart with \u0027@\u0027. This effectively catches both multiple markers (where\nthe second marker becomes the host) and unknown markers (which are not\nconsumed as markers and thus become the host), enforcing strict\ncompliance with the OpenSSH format.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: I13bb04d1f2610483ad9c6d1020e5100b6feded90\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782428\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "3872a2bc69f464352dea49c2856955ef7c5d5851", "tree": "d86b0a14871ed7977cad5203f03a0f28dd69d541", "parents": [ "9f72eccdf6fa09a7c68448a7fdc333dd2deb7d9d" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:51:30 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:24:24 2026 -0700" }, "message": "ssh/knownhosts: verify declared key type matches decoded key\n\nThe parseLine function previously ignored the key type field (e.g.,\n\"ssh-rsa\") in known_hosts entries, relying solely on the type\ninformation embedded within the base64-encoded key blob.\n\nOpenSSH\u0027s sshkey_read implementation explicitly verifies that the key\ntype declared in the text matches the type of the parsed key, returning\nSSH_ERR_KEY_TYPE_MISMATCH if they differ.\n\nThis change adds a check to ensure the declared key type matches\nkey.Type(), returning an error for malformed lines where they diverge.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Id4f35c74055f5691088273630b50cdd02c81bfe9\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782427\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "9f72eccdf6fa09a7c68448a7fdc333dd2deb7d9d", "tree": "6da6fb9953f01f178fb46816cf8a1a71364628bd", "parents": [ "8f405a4109d7ce87a44f89185bdc385914ce5c13" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:47:48 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:24:19 2026 -0700" }, "message": "ssh/knownhosts: treat only ASCII space and tab as whitespace\n\nThe previous implementation used bytes.TrimSpace, which strips all\nUnicode whitespace categories (e.g., non-breaking spaces). However,\nOpenSSH\u0027s known_hosts parser (hostfile.c) strictly treats only ASCII\nspace (0x20) and horizontal tab (0x09) as separators.\n\nThis discrepancy meant the Go parser might interpret fields differently\nthan OpenSSH, potentially treating parts of a key or hostname as\nseparators if they contained Unicode whitespace.\n\nThis change replaces bytes.TrimSpace with a local trimSpace helper that\nonly trims \" \\t\", ensuring parsing behavior consistent with the\nreference implementation.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Ia536889636de2c167d2507c01e3f1b7c033c9a8f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782426\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "8f405a4109d7ce87a44f89185bdc385914ce5c13", "tree": "60b7980c61f51be1a1cd48d59ccebbc36c2b4708", "parents": [ "bb41b3dbe630c21c78e3aeb0ebdd8d06a3a34fcf" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:35:21 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:24:14 2026 -0700" }, "message": "ssh: validate ECDSA curve matches expected algorithm\n\nPreviously, parseECDSA determined the curve purely based on the key\nblob content, ignoring the algorithm identifier passed to parsePubKey.\n\nThis allowed a mismatch where a key could be encoded with an algorithm\ntype of \"ecdsa-sha2-nistp256\" but contain a NIST P-384 or P-521 curve.\nThe parser would succeed, returning a key with a type different from\nthe one indicated by the caller/wire format.\n\nThis change updates parseECDSA to accept the expected algorithm type\nand verify that it matches the curve specified in the key data. This\nmatches the behavior of OpenSSH\u0027s ssh_ecdsa_deserialize_public in\nssh-ecdsa.c, which rejects a curve identifier that does not correspond\nto the key algorithm name.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: I9c748be948cca65e2f41089bb7510466d3bb316a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782425\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "bb41b3dbe630c21c78e3aeb0ebdd8d06a3a34fcf", "tree": "f885c12fa8a07774a64f125f51a7e0891fb6273d", "parents": [ "e04e7219970912a40f80c4b13029416fdf960eeb" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:26:02 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jun 02 00:23:03 2026 -0700" }, "message": "ssh: improve DH GEX group selection using PreferredBits\n\nPreviously, the server selected the Diffie-Hellman group based solely on\nthe MaxBits value provided by the client. This resulted in suboptimal\nmodulus selection, often ignoring the client\u0027s PreferredBits or selecting\na larger-than-necessary group.\n\nThis change implements a \"best fit\" selection algorithm similar to\nOpenSSH\u0027s choose_dh logic. It attempts to find the smallest available\ngroup larger than or equal to the client\u0027s PreferredBits, falling back to\nthe largest available group within the accepted range if no group above\nthe preference is available.\n\nAdditionally, this commit caches the parsed Oakley groups using\nsync.OnceValue, avoiding repeated big.Int parsing on every handshake\nwhile keeping the cost out of package initialization.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Idfa81bbcf354a7fb7b541cb4bbeb6e4a0181398a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782424\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "e04e7219970912a40f80c4b13029416fdf960eeb", "tree": "9f52f6a78988019ac4fee80c62b34fc01224ea32", "parents": [ "b315afd69a138d4d9d8bd44a9524bf78a37cf479" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 17:05:34 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:22:54 2026 -0700" }, "message": "ssh/agent: validate ed25519 private key length in Add\n\ninsertKey and insertCert assume an ed25519.PrivateKey is exactly\n64 bytes long: a 32-byte seed followed by a 32-byte public key.\nThe expression []byte(k)[32:] panics with \"slice bounds out of\nrange\" when a shorter slice is passed, which is reachable through\nthe exported Add API and crashes the caller process.\n\nReject ed25519 keys whose length is not ed25519.PrivateKeySize in\nall four branches (value and pointer variants of insertKey and\ninsertCert), using the same error wording already used by\nparseEd25519Cert in server.go.\n\nThis issue was found during a security audit by NCC Group\nCryptography Services, sponsored by Teleport, and was assessed\nand is being fixed as a non-security bug.\n\nChange-Id: I4a053835588aad4c3482fe1ca8045542cd960500\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782423\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b315afd69a138d4d9d8bd44a9524bf78a37cf479", "tree": "603602b4467985eb9775564007043fa13d510be5", "parents": [ "d4a85f4749786ae186cafe0ac4af0c21a59cfb9d" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 16:48:48 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:22:48 2026 -0700" }, "message": "ssh: limit bcrypt KDF rounds in OpenSSH private key decryption\n\npassphraseProtectedOpenSSHKey decodes the bcrypt round count from\nthe key file and passes it directly to bcrypt_pbkdf.Key, whose\nrunning time is linear in that count. Files specifying very large\nround values cause the decryption to consume excessive CPU time:\na uint32 maximum is several months of work on commodity hardware.\n\nCap the accepted round count at 2048 (128x the default of 16, a\nfew seconds of CPU on a modern core). OpenSSH itself does not\nimpose an upper bound, but accepting arbitrary values turns key\nloading into a resource-exhaustion footgun for any code that\nprocesses files supplied by end users.\n\nThis issue was found during a security audit by NCC Group\nCryptography Services, sponsored by Teleport, and was assessed\nand is being fixed as a non-security bug.\n\nChange-Id: I01112bdf1b484ae4fab5dc8841d1a272f112df74\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782422\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "d4a85f4749786ae186cafe0ac4af0c21a59cfb9d", "tree": "3c66c06a98bd6b6742525072e4abc4ae1cfba7c3", "parents": [ "6f39c5226a445a99a6d90f9f29a76feefb1c401f" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 16:42:08 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:22:42 2026 -0700" }, "message": "ssh/agent: limit RSA key size on Add requests\n\nparseRSAKey and parseRSACert build an rsa.PrivateKey directly from\nthe Add request body and then call priv.Precompute(). The CRT\ncoefficient recomputation in Precompute() is cubic in the size of\nthe prime factors, so accepting RSA keys with arbitrary modulus\nand prime sizes can consume excessive CPU resources during a\nsingle Add operation.\n\nAdd a checkRSAKeyParams helper that enforces the same bounds as\nparseRSA in the ssh package (modulus \u003c\u003d 8192 bits, exponent \u003c\u003d 24\nbits, exponent \u003e\u003d 3 and odd) plus a cap of 4096 bits on each prime\nfactor, and call it from both parseRSAKey and parseRSACert before\npriv.Precompute().\n\nThe previous inline check on the exponent (BitLen \u003e 30) is\nsubsumed by the new helper, which tightens it to BitLen \u003e 24 for\nconsistency with parseRSA.\n\nChange-Id: I6f0bbbfdc1db13d62a1f85e1d0e6ae517f000443\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782421\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "6f39c5226a445a99a6d90f9f29a76feefb1c401f", "tree": "0ce7f98d47315e0d9e69a55cacaf1deebec14525", "parents": [ "4c4d20b72c2ffcc65325634d57021774dd2a1750" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 16:25:01 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Tue Jun 02 00:22:37 2026 -0700" }, "message": "ssh: limit RSA key size in OpenSSH private key parsing\n\nparseOpenSSHPrivateKey builds an rsa.PrivateKey directly from the\nunmarshalled OpenSSH key blob, bypassing parseRSA and its modulus\nlimit. Validate() and Precompute() then perform several modular\nexponentiations whose cost grows with the size of the prime factors;\nin particular Precompute() recomputes the CRT coefficient as\nq^(p-2) mod p, which is cubic in |p|. A maliciously crafted key with\noversized N and P can keep the CPU busy for hours or days during a\nsingle load.\n\nMirror the parseRSA validation here: cap the modulus at 8192 bits\n(the same limit enforced by crypto/tls), reject exponents larger than\n24 bits, and reject invalid exponent values (\u003c 3 or even). In addition,\nbound each prime factor at 4096 bits to prevent the CRT computation\nfrom becoming the dominant cost.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Ia5991f25dd41a22eddd7cf63a8fc5106de9e9663\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782420\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "4c4d20b72c2ffcc65325634d57021774dd2a1750", "tree": "370e2c858141b4afd1154c9cccc04ccc0c9dbbd0", "parents": [ "e3e62d9601ec6fa737c081aead768f525f919802" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed May 27 11:17:19 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 28 10:16:30 2026 -0700" }, "message": "ssh: fix spinloop in mux SendRequest drain on closed channel\n\nThe drain loop added in 4e7a738 (\"ssh: fix deadlock on unexpected\nglobal responses\") receives from m.globalResponses without checking\nthe comma-ok flag. Once mux.loop closes globalResponses on connection\nteardown, the loop spins forever on the zero value, pinning a CPU\ncore for every concurrent SendRequest caller.\n\nUse the comma-ok idiom to detect the closed channel and break out.\n\nChange-Id: Icf0a7419fe5b206b7a4f70429fa9f25d0b5af731\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783681\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n" }, { "commit": "e3e62d9601ec6fa737c081aead768f525f919802", "tree": "cb2d896c54c263e080ddaf10641339c1fef9d320", "parents": [ "5adb68b3e6894a642e0f86712fcad2cd3e19c4e9" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed May 27 11:13:48 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 28 10:16:26 2026 -0700" }, "message": "ssh: fix spinloop in channel SendRequest drain on closed channel\n\nThe drain loop added in 3c7c869 (\"ssh: fix deadlock on unexpected\nchannel responses\") receives from ch.msg without checking the comma-ok\nflag. Once ch.msg is closed by channel.close(), receives succeed\nimmediately with the zero value, so the default arm is never taken\nand the loop spins forever, pinning a CPU core for every concurrent\nSendRequest caller on a torn-down channel.\n\nUse the comma-ok idiom to detect the closed channel and break out.\n\nFixes golang/go#79658\n\nChange-Id: Id80aa5d8429550c7a68e8759aed9ffba3aabb006\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783680\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n" }, { "commit": "5adb68b3e6894a642e0f86712fcad2cd3e19c4e9", "tree": "9574d50338940540a96955179dc0dc5566304b9c", "parents": [ "9beb694f9766a2c69fe6c89cfa6cf653a32b5a27" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun May 24 19:06:18 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed May 27 09:40:09 2026 -0700" }, "message": "ssh: cap total userauth attempts per server connection\n\nserverAuthenticate only bounded real failures via MaxAuthTries.\nPartialSuccessError responses and the publickey isQuery short-circuit\nboth kept the loop running without incrementing authFailures, so a\nclient could keep the server processing SSH_MSG_USERAUTH_REQUEST\nmessages indefinitely on a single connection.\n\nAdd an unconditional cap, maxAuthServerAttempts \u003d 128, on the total\nnumber of userauth requests handled per connection. The counter is\nincremented at the top of the loop before method dispatch, so every\nmethod and every isQuery / partial-success path counts. When the cap\nis exceeded the server sends SSH_MSG_DISCONNECT with reason 2 (\"too\nmany authentication attempts\"), mirroring the MaxAuthTries handling.\nThe bound is well below OpenSSH\u0027s hard cap of 1024 but above any\nrealistic multi-step auth flow.\n\nChange-Id: I56779fc55cd00ddfd32ec938f8de3a49be0145dc\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781903\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "9beb694f9766a2c69fe6c89cfa6cf653a32b5a27", "tree": "ecce4f5d5b4b326896d82ca36ec146f506c813a7", "parents": [ "e5306b2f3e9643bcc0ccac2034a48a294a68af74" ], "author": { "name": "Neal Patel", "email": "neal@golang.org", "time": "Tue May 19 20:31:25 2026 -0400" }, "committer": { "name": "Neal Patel", "email": "neal@golang.org", "time": "Mon May 25 19:49:21 2026 -0700" }, "message": "ssh: prevent malformed exit-status panic\n\nA malicious server can crash any client by sending\na truncated exit-status payload, which triggers a\npanic in binary.BigEndian.Uint32.\n\nChange-Id: Iff4fe182b40210c99d46562f6c3b5ecf38bb98b4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/780181\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n" }, { "commit": "e5306b2f3e9643bcc0ccac2034a48a294a68af74", "tree": "08d503005cbd6ecd3d034d11d818625080417c1b", "parents": [ "d2fe592df1852c42d472de6b51f6cb2fccb9171b" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Apr 19 20:32:53 2026 +0200" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 19:39:50 2026 -0700" }, "message": "ssh/agent: support parallel signing using request pipelining\n\nMake NewClient automatically pipeline concurrent requests over its\nconnection when the supplied io.ReadWriter also implements io.Closer.\nIn this mode the client writes requests to the wire as soon as the\nwrite path is available and dispatches responses back to callers in\nFIFO order via a dedicated reader goroutine, instead of fully\nserializing each call. Up to 32 requests may be in flight on a single\nconnection.\n\nThis lets an agent that load-balances signing across multiple backend\ndevices keep several of them busy concurrently without forcing callers\nto maintain their own connection pool. Aggregate throughput scales\nroughly linearly with the number of backend devices up to the\nin-flight cap; the protocol\u0027s in-order response requirement means\nslow requests still delay subsequent ones on the same connection,\nwhich is unchanged.\n\nThe pipelined path requires io.Closer because, on a Write error, the\nbackground reader goroutine must be unblocked by closing the\nunderlying connection; otherwise it would remain parked forever\nwaiting for a response that will never arrive, leaking the goroutine\nand desynchronising the FIFO routing of responses for subsequent\nsuccessful writes. When the supplied transport does not implement\nio.Closer, NewClient falls back to the previous fully-serialized\nbehavior: a single in-flight call at a time, with no background\ngoroutine.\n\nFixes golang/go#78473\n\nChange-Id: Icf14e5e8ca897506d68fb32c14fc72c774cd97b2\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/768483\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "d2fe592df1852c42d472de6b51f6cb2fccb9171b", "tree": "0cbf8b34e99bfcc7a66e0077fa0eb6fa70a058cf", "parents": [ "d59570d1a3152c5998e3f9b4b757514412a1472e" ], "author": { "name": "ding", "email": "ding@diinngg.com", "time": "Mon Dec 29 14:13:05 2025 +0000" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 19:39:36 2026 -0700" }, "message": "ssh: add openssh controlmaster socket support\n\nAdds support for establishing SSH sessions over an existing \"ControlMaster\" [unix domain] socket in proxy mode.\n\nDetails of the protocol can be found here: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.mux\nMore details about ControlMaster sockets can be found here: https://linux.die.net/man/5/ssh_config\n\nFixes golang/go#32958\n\nCo-authored-by: Cyrus Katrak \u003cckatrak@slack-corp.com\u003e\nChange-Id: Ia3ae8893262f5060ed3fadfcbe97619c9659145b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/733040\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\n" }, { "commit": "d59570d1a3152c5998e3f9b4b757514412a1472e", "tree": "a582152c78bdf3cb2e5a05deec63d2289b9cc1b9", "parents": [ "4aab0d9d6a195d489d47981f56bd3ecd08c98346" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed Mar 25 12:02:00 2026 +0100" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 19:36:57 2026 -0700" }, "message": "ssh: add AuthCallback to ClientConfig\n\nAdd ClientAuthCallback, a hook invoked before each authentication\nattempt that allows the client to dynamically select an auth method\nbased on server capabilities, partial successes, or previous failures.\n\nclientAuthenticate tracks partial successes in a slice and passes\nthem to AuthCallback via ClientAuthContext.PartialSuccessMethods,\nalong with the list of failed methods and currently allowed methods.\nWhen AuthCallback returns a non-nil AuthMethod, it is used for the\nnext attempt, bypassing the static findNext selection. When it\nreturns (nil, nil), the static config.Auth selection proceeds as\nbefore. If AuthCallback returns (nil, error) the handshake aborts\nimmediately with that error.\n\nTo bound resource use when AuthCallback keeps supplying methods, the\nclient caps the total number of authentication attempts (failures and\npartial successes combined) at 64; exceeding the cap aborts the\nhandshake with an error.\n\nFixes golang/go#76146\n\nChange-Id: I0d02bea7b9dd724e95e5d9d49d85306666c0df7a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/717140\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "4aab0d9d6a195d489d47981f56bd3ecd08c98346", "tree": "5d1d5e03a8afc1644c8b22d50653c0efd1350e8b", "parents": [ "a1c0d9929856c8aba2b31f079340f00578eda803" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Wed Mar 25 11:56:58 2026 +0100" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 19:36:47 2026 -0700" }, "message": "ssh: return partial success immediately from publickey auth\n\nChange publicKeyCallback to return authPartialSuccess to the caller\nimmediately when a signer receives partial success, instead of\ncontinuing to try remaining signers internally.\n\nThe caller (clientAuthenticate) already handles authPartialSuccess\nby not adding the method to \"tried\", so findNext can re-select\npublickey on the next iteration. When it does, all signers are\ntried again from the beginning.\n\nChange-Id: Icc87721aa56ef59a357e409aa046640a27e5fc46\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/757900\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "a1c0d9929856c8aba2b31f079340f00578eda803", "tree": "fc8036ec469d294974c26ffbce23242fd5bf0dbc", "parents": [ "3c7c86938f4541c333d506f719388d9c42d4763d" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 21 17:13:39 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 21 17:26:06 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ia739869d49c750c7fa578b9dbd7bb998d8c87087\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781683\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n" }, { "commit": "3c7c86938f4541c333d506f719388d9c42d4763d", "tree": "abbec0c2c675deca1dde3d637acb2aa06901f63d", "parents": [ "533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce" ], "author": { "name": "Nicola", "email": "nicola.murino@gmail.com", "time": "Tue Apr 21 21:43:00 2026 +0200" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:09:12 2026 -0700" }, "message": "ssh: fix deadlock on unexpected channel responses\n\nPreviously, channel.handlePacket sent channelRequestSuccess and\nchannelRequestFailure messages to ch.msg unconditionally via the default\narm of its type switch. Because ch.msg is a bounded buffer (chanSize),\na peer that sends a burst of unsolicited channel request responses for\nan open, idle channel fills the buffer and blocks the mux read loop on\nthe next send. That stalls all packet processing on the connection,\nand because readLoop then backs up on t.incoming, closing the\nunderlying net.Conn does not unblock either goroutine: user code\nobserves Close() returning promptly while Wait() hangs and the mux,\nreadLoop, and kexLoop goroutines leak permanently.\n\nThis change mirrors the fix for the mux-level SendRequest path: a\nsentRequestPending atomic gate is set while a SendRequest with\nWantReply is in flight, handlePacket drops responses when the gate is\nclosed, and uses a non-blocking send otherwise. SendRequest drains\nany spurious response that slipped through before discarding it, so\nthe caller always observes the reply to its own request.\n\nThis aligns with OpenSSH, which silently ignores channel confirm\nmessages that do not match a pending request.\n\nFixes golang/go#79564\nFixes CVE-2026-39830\n\nChange-Id: I15e2add4bf7876bb0c6f921f8b57203d97e83f47\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781664\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce", "tree": "2215c94ae92c2aea2cc51e5e7bca2e4972fb14f8", "parents": [ "abbc44d451a6f9236a2bbd26cbcd4d0fec473da3" ], "author": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Fri May 15 19:57:52 2026 +0000" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:26 2026 -0700" }, "message": "ssh: fix source-address critical option bypass\n\nPreviously, CVE-2024-45337 fixed an authorization bypass\nfor misused ssh server configurations; if any other type\nof callback is passed other than public key, then the\nsource-address validation would be skipped.\n\nFixes CVE-2026-46595\nFixes golang/go#79570\n\nChange-Id: I08d86a961048a232c8672f23000e693ed5a0e2fd\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781642\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "abbc44d451a6f9236a2bbd26cbcd4d0fec473da3", "tree": "197ba22e8afed01f262b464fb18fe4c2cee5e508", "parents": [ "e052873987615dc96fe67607a9a6adb76311344f" ], "author": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Fri May 15 20:04:07 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 21 17:03:25 2026 -0700" }, "message": "ssh: fix incorrect operator order\n\nArithmetic is incorrectly applied to \u0027byte\u0027\ninstead of \u0027int\u0027 resulting in a possible\noverflow that allows for a panic.\n\nFixes CVE-2026-46597\nFixes golang/go#79561\n\nChange-Id: I83edabeeda676f0209d29d5e2554890bbd0eef8f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781620\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e052873987615dc96fe67607a9a6adb76311344f", "tree": "bf60f761a4a3293bdf8f87d7ae79b9767d07a3de", "parents": [ "b61cf853a89d82cad68da5e12a6beca2116f8456" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Dec 14 15:32:31 2025 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:23 2026 -0700" }, "message": "ssh: fix infinite loop on large channel writes due to integer overflow\n\nThe internal \u0027min\u0027 helper function in channel.go incorrectly cast the\ninput data length (int) to uint32 before comparing it with the\nmaximum packet size. On 64-bit systems, if the data length is a\nmultiple of 2^32 (approx. 4GB), this cast results in 0.\n\nConsequently, the function returns 0, causing the WriteExtended loop\nto spin indefinitely because it attempts to reserve 0 bytes while\nthe remaining data length is still positive.\n\nThis change renames the helper to \u0027minPayloadSize\u0027 to avoid confusion\nwith the Go 1.21 built-in \u0027min\u0027 and updates the logic to use int64\nfor comparisons, preventing truncation and the resulting infinite loop.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79567\nFixes CVE-2026-39834\n\nChange-Id: Id5bf81d9f06c7042452acffe1c76580ff878665e\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781663\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b61cf853a89d82cad68da5e12a6beca2116f8456", "tree": "995091a411954bd525bc36ec370c3681b31273f9", "parents": [ "9c2cd33e8d96a96133fd6ff732510ebba539c2bd" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Feb 15 15:24:27 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:20 2026 -0700" }, "message": "ssh: enforce user presence verification for security keys\n\nPreviously the library did not verify the \"User Presence\" (UP) bit in\nsignatures generated by FIDO/U2F security keys\n(sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com).\nThis allowed signatures without physical interaction to be accepted\nif the underlying hardware produced them, deviating from the default\nsecure behavior expected by the FIDO standards and OpenSSH.\n\nskECDSAPublicKey.Verify and skEd25519PublicKey.Verify now enforce\nthe user-presence bit (0x01, constant flagUserPresence) by default.\nSignatures whose flags byte has UP clear fail with the sentinel\nerrSKMissingUserPresence.\n\nThe server public-key authentication path honors the OpenSSH\n\"no-touch-required\" extension as an opt-out. noTouchAllowed reports\ntrue when the extension is present either in the Permissions\nreturned by PublicKeyCallback (authorized_keys-level opt-out) or in\nthe certificate\u0027s own Extensions (CA-level opt-out); in that case\nskKeyWithoutUP is used to derive a clone of the SK public key (and,\nfor certificates, a clone of the wrapping Certificate whose inner\nKey is the cloned SK key) whose Verify accepts UP-clear signatures.\nThe originals are never mutated, so a per-session opt-out cannot\nleak across authentication attempts or connections. Matching\nOpenSSH, the opt-out is read only from Extensions, never from\nCriticalOptions.\n\nskKeyWithoutUP is iterative and unwraps at most one level of\n*Certificate: the SSH cert format forbids Certificate.Key from being\nanother Certificate (parseCert rejects it) but callers can still\nconstruct such a value directly in Go, so a recursive descent would\nbe driven to unbounded depth by malformed or cyclic input. Any such\npathological *Certificate is returned unchanged.\n\nCertChecker.CheckCert applies skKeyWithoutUP unconditionally to the\ncertificate\u0027s CA key before verifying the CA signature, matching\nOpenSSH, which calls sshkey_verify with detailsp\u003d\u003dNULL in\nsshkey.c:cert_parse and never extracts or enforces UP/UV flags on\nCA signatures. The UP bit on a CA signature reflects the CA\noperator\u0027s presence at cert-issuance time, which has no bearing on\nwhether the user being authenticated is present now, so enforcing it\nhere would only break interop with certificates issued by\nnon-interactive SK CAs without a corresponding security benefit. The\nskKeyWithoutUP call is a no-op for non-SK CA keys (the common case).\n\nThis change breaks backward compatibility for clients or keys that\ngenerate user-authentication signatures without the User Presence\nflag set. Previously those signatures were accepted by the server.\nThey will now be rejected with \"ssh: signature missing required user\npresence flag\" unless the \"no-touch-required\" extension is\nexplicitly granted to the session by the server callbacks, or\ncarried by the user certificate.\n\nThis issue was found during a security audit by NCC Group\nCryptography Services, sponsored by Teleport.\n\nFixes golang/go#79566\nFixes CVE-2026-39831\n\nChange-Id: I74b6de3bb6a2d7a0f34d7fa36bbbbf06f0b3fc6b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781662\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "9c2cd33e8d96a96133fd6ff732510ebba539c2bd", "tree": "22a51705a0ec4475dc83c3544da6590a4b17378f", "parents": [ "890731877d85f71cfdc9554e7a27fec4684fc4c4" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jan 25 15:19:52 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:16 2026 -0700" }, "message": "ssh: enforce strict limits on DSA key parameters\n\nThe parseDSA function previously accepted DSA keys with arbitrary values\nfor the sub-prime Q and did not validate that group elements G and Y\nwere within the modulus P.\n\nMalicious actors could provide a key with a massively large Q (e.g.,\nmillions of bits), leading to excessive CPU consumption during signature\nverification.\n\nThis change restricts the sub-prime Q to exactly 160 bits, as required\nby FIPS 186-2, and ensures that G and Y are strictly less than P.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79565\nFixes CVE-2026-39829\n\nChange-Id: I526118d94684076088d0625178844f64c1303ec8\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781661\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n" }, { "commit": "890731877d85f71cfdc9554e7a27fec4684fc4c4", "tree": "9443a33f5895c5293c9e3b228671e2d6a035247b", "parents": [ "ffd87b4878fa98ca2908ec534e1a410bf095a35e" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Feb 01 13:10:56 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:13 2026 -0700" }, "message": "ssh: reject RSA keys with excessively large moduli\n\nPreviously, the RSA key parser accepted keys with arbitrary modulus\nsizes. Processing keys with extremely large moduli (e.g., \u003e 8192 bits)\ncan consume excessive CPU resources during verification, potentially\nleading to a Denial of Service (DoS).\n\nThis change introduces a limit of 8192 bits for the RSA modulus in\nparseRSA, rejecting keys that exceed this size in line with the limit\nenforced by crypto/tls.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79565\nFixes CVE-2026-39829\n\nChange-Id: Ibdddad1859a4d9db5c9f052d06c82f29bfc2e5e5\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781641\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "ffd87b4878fa98ca2908ec534e1a410bf095a35e", "tree": "97509a55df9b0c0f560a0e818c1259463f258663", "parents": [ "4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jan 25 15:55:17 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:03:09 2026 -0700" }, "message": "ssh: fix panic when authority callbacks are nil\n\nPreviously, if CertChecker.IsHostAuthority or CertChecker.IsUserAuthority\nwere left unset, calling CheckHostKey or Authenticate would result in a\nnil pointer dereference panic.\n\nThis change adds checks to ensure these callbacks are defined before\ninvocation, returning an error instead of panicking.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79563\nFixes CVE-2026-39835\n\nChange-Id: I2bd9c8d76646232e49f6aedc7b5334f3825918be\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781660\nCommit-Queue: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n" }, { "commit": "4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946", "tree": "5067c91a730b6d9483b1d565042f2b57742a8099", "parents": [ "b25012b37bb33a8d0a59388aad6b32e43ce87225" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Jan 25 19:08:01 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 17:02:53 2026 -0700" }, "message": "ssh: fix deadlock on unexpected global responses\n\nPreviously, the mux implementation handled global request responses by\nblocking until the response could be sent to the globalResponses channel.\nSince this channel has a buffer size of 1, unsolicited responses from a\nserver (or responses arriving after a timeout) would fill the buffer.\nSubsequent unsolicited responses would block handleGlobalPacket, stalling\nthe entire connection\u0027s read loop and causing a denial of service.\n\nThis change modifies handleGlobalPacket to use a non-blocking send. If\nno goroutine is waiting for a response (or the buffer is full), the\nmessage is dropped. This aligns with OpenSSH behavior, which ignores\nunexpected global responses.\n\nAdditionally, SendRequest now drains the globalResponses channel after\nacquiring the mutex but before sending the request. This ensures that\nany stale responses or \"spam\" buffered just before the lock was acquired\nare discarded, preventing race conditions where a legitimate request\nmight otherwise consume an unrelated response.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79564\nFixes CVE-2026-39830\n\nChange-Id: Ia0c46355203d557eadcd432c10b87c8a044e1089\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781640\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b25012b37bb33a8d0a59388aad6b32e43ce87225", "tree": "8d3377f9f0c3150ee70a351fbdacd4f44d922923", "parents": [ "6c195c8a97ae3d91a366ebdd7787d5faa64bf42a" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Feb 01 17:55:09 2026 +0100" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 21 17:00:58 2026 -0700" }, "message": "ssh: enforce nil Permissions when returning PartialSuccessError\n\nIn serverAuthenticate, the permissions variable is reset to nil at the\nbeginning of the authentication loop. If an authentication callback\nreturns a PartialSuccessError along with non-nil Permissions, those\npermissions are currently silently discarded before the next\nauthentication step.\n\nThis change returns an error if a callback returns both a PartialSuccessError\nand non-nil Permissions, preventing API misuse where the user might\nerroneously expect those permissions to be preserved or merged into the\nfinal session permissions.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79562\nFixes CVE-2026-39828\n\nChange-Id: I632c9e46e2b5e8804ef88081063a3612a2462f9f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781621\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "6c195c8a97ae3d91a366ebdd7787d5faa64bf42a", "tree": "6cb4adb78f6f816a8cde9a4106630f4119cd0aa9", "parents": [ "f717e29698a271c548239ed56bf5dd9516d6f7e8" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Sun Mar 01 11:49:28 2026 +0100" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 11:00:25 2026 -0700" }, "message": "ssh: prevent memory leak when rejecting channels\n\nWhen a server rejects an incoming channel request via\nNewChannel.Reject, the channel is left in the multiplexer\u0027s\nchannel list. Because the channel is never explicitly removed or\nclosed, its internal buffers and sync primitives remain allocated\nfor the lifetime of the SSH connection.\n\nA malicious client could exploit this behavior by repeatedly\nrequesting to open channels that are destined to be rejected,\ncausing unbounded memory growth and potentially leading to a\nDenial of Service (DoS) via resource exhaustion.\n\nThis change fixes the leak by calling ch.mux.chanList.remove\nwithin the Reject method, removing the channel from the list and allowing the\ngarbage collector to reclaim the associated memory immediately.\n\nFixes golang/go#35127\nFixes CVE-2026-3982\n\nChange-Id: Iaa177f5dfd151812dd404e528a4a1c77527a0e29\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781320\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "f717e29698a271c548239ed56bf5dd9516d6f7e8", "tree": "965b8059de5cf38ee29474d68ce4cc2ebfdf53d9", "parents": [ "e7c36ccb477ccdb9f0f9b77025a9384de23dcc9c" ], "author": { "name": "Neal Patel", "email": "neal@golang.org", "time": "Thu May 21 10:07:47 2026 -0400" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Thu May 21 10:58:49 2026 -0700" }, "message": "ssh/knownhosts: respect @revoked CA keys\n\nFixes CVE-2026-42508\nFixes golang/go#79568\n\nChange-Id: I20f33cba20756b048726ff3464b83871859d3b5c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781220\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "e7c36ccb477ccdb9f0f9b77025a9384de23dcc9c", "tree": "c58b8ac61368c4d0eb0e0cb6a903972a393b32e8", "parents": [ "0fb843a472225645e917c84f1f9744757f0bab14" ], "author": { "name": "Neal Patel", "email": "neal@golang.org", "time": "Thu May 21 10:29:46 2026 -0400" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 10:55:07 2026 -0700" }, "message": "ssh/agent: prevent panic on pathological ed25519 inputs\n\nparseEd25519Key and parseEd25519Cert cast wire bytes\nto ed25519.PrivateKey without checking length; a short\npayload panics at priv[32:] in Public().\n\nFixes CVE-2026-46598\nFixes golang/go#46598\n\nChange-Id: I127bc6a22adff1c4beb4d54533062bebc388de47\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781360\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n" }, { "commit": "0fb843a472225645e917c84f1f9744757f0bab14", "tree": "e34d63d38cbe8878f4c81131cbb9fb10e0a0ed8a", "parents": [ "e3d1254f1e7e60baa086142c46174bf6d8d0fe50" ], "author": { "name": "Nicola", "email": "nicola.murino@gmail.com", "time": "Sun Feb 08 15:28:56 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 10:54:57 2026 -0700" }, "message": "ssh/agent: reject keys with unsupported confirm constraint\n\nThe in-memory keyring supports the \"lifetime\" constraint but does not\nimplement the \"confirm\" constraint. Previously, keyring.Add silently\nignored ConfirmBeforeUse: the key was stored, advertised through List,\nand used for signing without any interactive confirmation, potentially\nmisleading callers into believing this security measure was enforced.\n\nReturn an error when ConfirmBeforeUse is set instead of silently\ndowngrading the caller\u0027s security expectations. Implementing real\nconfirm-before-use in an in-memory library keyring is infeasible (there\nis no UI or confirmation callback), so failing closed is the correct\nbehavior; adding actual confirm support would require an API addition\nand is out of scope.\n\nThis is a deliberate behavior change: keyring.Add previously accepted\nand ignored ConfirmBeforeUse and now returns an error. This change also\nupdates the keyring doc comments to document the supported constraints.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes CVE-2026-39833\nUpdates golang/go#47533\nFixes golang/go#79436\n\nChange-Id: I1b3a286f0c1e4a4e08ac37109f7e491692ca90ae\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/778642\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e3d1254f1e7e60baa086142c46174bf6d8d0fe50", "tree": "42c90fb38b124694dcc3e5fbe5472f4241796095", "parents": [ "a1ce0fee129597fdea8dfd58d71b6b607de6bdce" ], "author": { "name": "Nicola", "email": "nicola.murino@gmail.com", "time": "Sun Feb 01 14:55:12 2026 +0100" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu May 21 10:47:08 2026 -0700" }, "message": "ssh/agent: don\u0027t accept keys with unsupported constraints\n\nThe in-memory keyring cannot enforce constraint extensions, so silently\naccepting a key that carries them gave callers a false sense of\nrestriction. Refuse keys with constraint extensions instead: a key\nwhose constraints cannot be enforced must not be loaded. This behavior\nis consistent with OpenSSH.\n\nThis is a deliberate behavior change: keyring.Add previously accepted\nand ignored ConstraintExtensions and now returns an error.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes CVE-2026-39832\nFixes golang/go#79435\n\nChange-Id: I6ca4f1c29f8edfabb287fe07299641f70896d5fe\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/778641\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n" }, { "commit": "a1ce0fee129597fdea8dfd58d71b6b607de6bdce", "tree": "f9da4efb4e1270e5cb838bfdb494a99bbeb93c0c", "parents": [ "a749d17980b8eb54b34872d8d8f2c90d69442cc5" ], "author": { "name": "Nicola", "email": "nicola.murino@gmail.com", "time": "Tue Jan 27 12:15:18 2026 +0100" }, "committer": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Thu May 21 10:43:27 2026 -0700" }, "message": "ssh/agent: preserve constraint extensions when adding keys\n\nThe client Add method only serialized the lifetime and confirm\nconstraints and silently dropped AddedKey.ConstraintExtensions before\nsending the SSH_AGENTC_ADD_IDENTITY request. As a result the remote\nagent always received the key with no extension constraints, regardless\nof what the caller requested.\n\nApplications that add a key believing custom constraint extensions\n(such as restrict-destination-v00@openssh.com) would be enforced\ninstead loaded a completely unrestricted key into the agent. For\nexample, an administrator forwarding their agent into an untrusted jump\nhost and trying to limit the forwarded key with restrict-destination\nnever had that restriction reach the agent: any user or compromised\nprocess on that host could make the agent sign arbitrary challenges.\n\nSerialize each entry in key.ConstraintExtensions as an\nagentConstrainExtension constraint so the constraints reach the agent,\nand add a round-trip regression test that verifies the extensions\nsurvive client serialization and server parsing.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nUpdates CVE-2026-39832\nUpdates golang/go#79435\n\nChange-Id: I14c5583b106cbf0d282d2ba01e000e0f586f08c7\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/778640\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Keith Randall \u003ckhr@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "a749d17980b8eb54b34872d8d8f2c90d69442cc5", "tree": "8bb3dcda5156d727a5ccbb1d20b7b2809b611ee8", "parents": [ "7ee59707ff302869e7667032223ed3f10711c3b3" ], "author": { "name": "Roland Shoemaker", "email": "roland@golang.org", "time": "Wed May 14 16:45:48 2025 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon May 18 11:44:40 2026 -0700" }, "message": "chacha20poly1305: remove usages of BYTE instr\n\nWe have had VBROADCASTI128 since at least Go 1.11, so no need to use\nBYTE instructions.\n\nChange-Id: I297bbc636320ae830f6e8f83eb174efe8251a9a3\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/672838\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n" }, { "commit": "7ee59707ff302869e7667032223ed3f10711c3b3", "tree": "8aea44b2952e8f591fd0efb04b0583b9b93191f5", "parents": [ "44decbfe70e24dc0e2727f2bde648d06e62667fd" ], "author": { "name": "Roland Shoemaker", "email": "roland@golang.org", "time": "Wed May 14 13:20:15 2025 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon May 18 11:44:36 2026 -0700" }, "message": "chacha20poly1305: drop pre-AVX assembly impl\n\nUpdates golang/go#69587\n\nChange-Id: Ic158558f879b8b8ad23155bf887e083169096d19\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/672837\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n" }, { "commit": "44decbfe70e24dc0e2727f2bde648d06e62667fd", "tree": "d8146dde5072c1cf38a4b63b225bf6036aafed66", "parents": [ "b8a14a8d65f88c0c79c139171f1354c69a6cdb8a" ], "author": { "name": "Dmitri Shuralyov", "email": "dmitshur@golang.org", "time": "Fri May 08 11:42:28 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon May 11 07:38:31 2026 -0700" }, "message": "blake2b: merge go125.go into blake2b_test.go\n\nThe go1.25 build constraint is guaranteed to always be satisfied because\nthe go directive is at 1.25.0, so the separated out go125.go file is not\nneeded. Move the assertion that the *xof type implements the hash.XOF\ninterface into a _test.go file to let it happen alongside other tests\nin this package.\n\nChange-Id: I65c886ede4d574a3168f28689f9529aa56586697\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/775781\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Hyang-Ah Hana Kim \u003chyangah@gmail.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "b8a14a8d65f88c0c79c139171f1354c69a6cdb8a", "tree": "b218d5b69a1a6527e3e88116dd5ecfc6191fa5c0", "parents": [ "9d9d5078968ddb8a279092c665a24e7de4178778" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Fri May 08 08:12:50 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Fri May 08 11:32:18 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ie3eba6549d69698b6dd089c7e49f7c30198dc2bb\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/775841\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n" }, { "commit": "9d9d5078968ddb8a279092c665a24e7de4178778", "tree": "36cd0d59841afaff68d7f4000235d4ee6f9aee22", "parents": [ "fd0b90d21f9ab4b5dd398e9526b570bfea86e370" ], "author": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Fri May 08 09:38:51 2026 -0400" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Fri May 08 08:10:15 2026 -0700" }, "message": "x509roots/fallback/bundle: fix bundle test with Go 1.27+\n\nIn Go 1.27 we\u0027ve updated crypto/x509/pkix to avoid hex-encoding\nattribute values that are string-typed. However, in TestBundle() we\nassert the parsed certificate subject CN matches expected and now the\nparsed value differs based on Go version.\n\nThis commit introduces some small helpers that on Go 1.25/1.26 replicate\nthe Go 1.27 behavior, decoding hex-encoded attribute values before\nmaking the comparison.\n\nIn this way the test continues to pass without losing any coverage, or\nintroducing duplicated per-version bundles. In the future when only Go\n1.27+ are supported we can revert this extra machinery.\n\nChange-Id: I66bf6439e421169c0f9c750f88116b73ec5188fe\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/775760\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n" }, { "commit": "fd0b90d21f9ab4b5dd398e9526b570bfea86e370", "tree": "9cf93e4be05d2063040fb2dbecc31ee7e523903c", "parents": [ "b9e53593a6073e6a786c49e9ad27956a9b77e54e" ], "author": { "name": "repon", "email": "repon@google.com", "time": "Wed Apr 22 12:12:18 2026 +0200" }, "committer": { "name": "Daniel McCarney", "email": "daniel@binaryparadox.net", "time": "Fri May 01 10:44:32 2026 -0700" }, "message": "acme: include Problem in OrderError.Error\n\nAn ACME Order object can contain an error field when it is invalid.\nPreviously, OrderError.Error() ignored this field, making it difficult\nto diagnose why an order failed. This change includes the problem\ndetails if available.\n\n\nChange-Id: I461fd02ef02251a2ba1e8cea39b5df8070938117\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/772880\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Sean Liao \u003csean@liao.dev\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n" }, { "commit": "b9e53593a6073e6a786c49e9ad27956a9b77e54e", "tree": "ba1ebb853725f455eec33fc587bbe00a0ddb85de", "parents": [ "cc0e4fc1d49127130b0d00612a2eeed2ab745d40" ], "author": { "name": "Filippo Valsorda", "email": "filippo@golang.org", "time": "Wed Apr 22 12:12:18 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu Apr 23 08:20:11 2026 -0700" }, "message": "pbkdf2: turn into a wrapper for crypto/pbkdf2\n\nChange-Id: If95f1d771404fe88a8f9bc0a17b5a4d16a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/769721\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "cc0e4fc1d49127130b0d00612a2eeed2ab745d40", "tree": "18d2d6d1dc70bdeea1c9376e5065359960e6872c", "parents": [ "a8e9237a216b050e1b11e041863825104a6811db" ], "author": { "name": "Filippo Valsorda", "email": "filippo@golang.org", "time": "Wed Apr 22 12:04:56 2026 +0200" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu Apr 23 08:20:08 2026 -0700" }, "message": "hkdf: forward Extract to the standard library\n\nChange-Id: I82406eb153c53e7cbf167360e472724a6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/769720\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nAuto-Submit: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "a8e9237a216b050e1b11e041863825104a6811db", "tree": "cd2f4dc08f6d936822748cbc3291c1e0ff3f8b56", "parents": [ "03ca0dcccbd37ba6be80adf74dde8d78a4d72817" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Apr 13 16:01:00 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Apr 13 10:03:23 2026 -0700" }, "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I9bad7b49959a336a125bdc3aa340c94292b26899\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/766500\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "03ca0dcccbd37ba6be80adf74dde8d78a4d72817", "tree": "0b3de44ff8d5f70eb61e2153bf977bd3ecbbaacf", "parents": [ "8400f4a938077a7a7817ab7d163d148e371b320b" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu Apr 09 05:03:48 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Thu Apr 09 08:33:22 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ia33bd1cd73db091960b285c234d2cf2622f30943\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/764501\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n" }, { "commit": "8400f4a938077a7a7817ab7d163d148e371b320b", "tree": "df6915b759ea07d0c031b981c6c0d17843703e7b", "parents": [ "81c6cb34a8fc386ed53293cd79e3c0c232ee7366" ], "author": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Mon Feb 16 10:38:19 2026 +0100" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Mar 23 08:34:51 2026 -0700" }, "message": "ssh: respect signer\u0027s algorithm preference in pickSignatureAlgorithm\n\nPreviously, pickSignatureAlgorithm constructed the list of candidate\nalgorithms by iterating over the static list returned by\nalgorithmsForKeyFormat. This caused the Signer\u0027s preference order\nto be ignored in favor of the library\u0027s default internal order.\n\nThis change inverts the filtering logic to iterate over the signer\u0027s\nsupported algorithms first. This ensures that if a MultiAlgorithmSigner\nexplicitly prefers a specific algorithm (e.g., rsa-sha2-512 over\nrsa-sha2-256), that preference is preserved and respected during the\nhandshake negotiation.\n\nFixes golang/go#78248\n\nChange-Id: I48a0aac720be7f973963342b82047ce32fc96699\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/746020\nReviewed-by: Lonny Wong \u003clonnywang.cn@gmail.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n" }, { "commit": "81c6cb34a8fc386ed53293cd79e3c0c232ee7366", "tree": "b68cf9aed3339baaede7e9a3cd98e7f97bcf943c", "parents": [ "982eaa62dfb7273603b97fc1835561450096f3bd" ], "author": { "name": "Rob Picard", "email": "rob.picard@goteleport.com", "time": "Thu Mar 12 11:17:52 2026 -0600" }, "committer": { "name": "Nicola Murino", "email": "nicola.murino@gmail.com", "time": "Fri Mar 20 08:28:06 2026 -0700" }, "message": "ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength\n\nThe existing code uses cbcMinPaddingSize incorrectly. That value is\nalso used in the first parameter of the max call, meaning it will\nnever be used.\n\nFixes golang/go#78062\n\nChange-Id: I4243ab668168313919df33d78c6965e9eff0e934\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/754780\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "982eaa62dfb7273603b97fc1835561450096f3bd", "tree": "b0b00977a0818ffdc7ef456e7247281c28788473", "parents": [ "159944f128e9b3fdeb5a5b9b102a961904601a87" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Mar 11 05:56:32 2026 -0700" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Mar 11 07:17:49 2026 -0700" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ic40aa8385f00dc3d3e3588a0e2555c8039ae6017\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/754160\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "159944f128e9b3fdeb5a5b9b102a961904601a87", "tree": "ecb65c74db2b73ca81d1387af1e393a20876bf54", "parents": [ "a408498e55412f2ae2a058336f78889fb1ba6115" ], "author": { "name": "Neal Patel", "email": "nealpatel@google.com", "time": "Tue Jan 27 21:32:36 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Mar 10 10:37:09 2026 -0700" }, "message": "ssh,acme: clean up tautological/impossible nil conditions\n\nChange-Id: I4c6b4b6d8dc1e8a9d2ebfb8d350b7617d3cf7949\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/739780\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n" }, { "commit": "a408498e55412f2ae2a058336f78889fb1ba6115", "tree": "9bb721b4642324d10b8184b4429eef82c8d4c1eb", "parents": [ "cab0f718548e8a858701b7b48161f44748532f58" ], "author": { "name": "Sean Liao", "email": "sean@liao.dev", "time": "Sun Nov 09 12:55:47 2025 +0000" }, "committer": { "name": "Sean Liao", "email": "sean@liao.dev", "time": "Fri Feb 13 09:12:11 2026 -0800" }, "message": "acme: only require prompt if server has terms of service\n\nFixes golang/go#64881\n\nChange-Id: I2b4415e6f987aab258c26c090ac7b1a465aa1697\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/719001\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n" }, { "commit": "cab0f718548e8a858701b7b48161f44748532f58", "tree": "ef2b9eb9aeb87ee58dcd3a3e9bc783037b208ea4", "parents": [ "2f26647a795e74e712b3aebc2655bca60b2686f9" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Feb 11 18:54:17 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Wed Feb 11 11:12:56 2026 -0800" }, "message": "all: upgrade go directive to at least 1.25.0 [generated]\n\nBy now Go 1.26.0 has been released, and Go 1.24 is no longer supported\nper the Go Release Policy (see https://go.dev/doc/devel/release#policy).\n\nSee go.dev/doc/godebug#go-125 for GODEBUG changes relevant to Go 1.25.\n\nFor golang/go#69095.\n\n[git-generate]\n(cd . \u0026\u0026 go get go@1.25.0 \u0026\u0026 go mod tidy)\n(cd x509roots/fallback \u0026\u0026 go get go@1.25.0 \u0026\u0026 go mod tidy)\n\nChange-Id: I8df6bf58a117a2f92bb08f787e520aa9446dab46\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/744680\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\n" }, { "commit": "2f26647a795e74e712b3aebc2655bca60b2686f9", "tree": "db229ff33ba0e1b2fc3089aeb98b0ec8c35faa50", "parents": [ "e08b06753d6a72f1fe375b6e0fefefb39917c165" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Feb 09 21:14:04 2026 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Feb 09 13:49:22 2026 -0800" }, "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I3665d29edabaef0efb634031b2b7d20d32774eec\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/743540\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n" }, { "commit": "e08b06753d6a72f1fe375b6e0fefefb39917c165", "tree": "34f94d86425b7c0974c6060c69455bca42565d6d", "parents": [ "7d0074ccc6f17acbf2ebb10db06d492e08f887dc" ], "author": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Feb 09 08:29:51 2026 -0800" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Mon Feb 09 08:37:10 2026 -0800" }, "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I1b283104f6d4557ee12c256bbadfccb3cd5548be\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/743362\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n" }, { "commit": "7d0074ccc6f17acbf2ebb10db06d492e08f887dc", "tree": "8ae802c545076b19fa5f72f44f8b303039aafa41", "parents": [ "506e022208b864bc3c9c4a416fe56be75d10ad24" ], "author": { "name": "Juergen Graf", "email": "juergen.graf@gmail.com", "time": "Mon Dec 22 01:27:49 2025 +0000" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Jan 13 07:44:11 2026 -0800" }, "message": "scrypt: fix panic on parameters \u003c\u003d 0\n\nProviding 0 as argument for r or p results in a panic:\npanic: runtime error: integer divide by zero\n\nProviding negative values for r or p returns a misleading error:\nscrypt: parameters are too large\n\nThis change avoids the panic and introduces a new error\nthat is returned when r or p are \u003c\u003d 0:\nscrypt: parameters must be \u003e 0\n\nChange-Id: I68987b27d1eedd66644d2ec9436cba364fc1d46d\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/731780\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n" } ], "next": "506e022208b864bc3c9c4a416fe56be75d10ad24" }