HIGH 7.5
GHSA-q4h4-gmj2-qvw2
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
Quick fix
GHSA-q4h4-gmj2-qvw2 — golang.org/x/crypto: upgrade to the fixed version with the command below.
go get golang.org/x/crypto@v0.52.0Details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Are you affected?
Enter the version of the package you're using.