How severe is CVE-2026-46598?

CVE-2026-46598 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-46598 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-46598?

CVE-2026-46598 affects Golang Crypto. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-46598?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-46598 have an EU (EUVD) identifier?

Yes. CVE-2026-46598 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31402.

When was CVE-2026-46598 published?

CVE-2026-46598 was published on 2026-05-22 and last updated on 2026-06-17.

CVE-2026-46598

CVE-2026-46598 is a medium-severity vulnerability in Golang Crypto with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-31402
Weakness: CWE-129
Affected product: Golang Crypto
Published: 2026-05-22
Last modified: 2026-06-17

Description

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Frequently asked questions

What is CVE-2026-46598?: For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
How severe is CVE-2026-46598?: CVE-2026-46598 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-46598 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-46598?: CVE-2026-46598 affects Golang Crypto. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-46598?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-46598 have an EU (EUVD) identifier?: Yes. CVE-2026-46598 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31402.
When was CVE-2026-46598 published?: CVE-2026-46598 was published on 2026-05-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

More vulnerabilities in Golang Crypto

CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-42508 — Critical (CVSS 9.1): Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key'…
CVE-2026-39834 — Critical (CVSS 9.1): When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload…
CVE-2026-39833 — Critical (CVSS 9.1): The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never…
CVE-2026-39832 — Critical (CVSS 9.1): When adding a key to a remote agent constraint extensions such as [email protected] were not…
CVE-2026-39831 — Critical (CVSS 9.1): The Verify() method for FIDO/U2F security key types ([email protected], [email protected])…

All CVEs affecting Golang Crypto →

Other CWE-129 (Improper Validation of Array Index) vulnerabilities

CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.

Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →