ClickHouse / ClickHouse/clickhouse-go
security: High-severity vulnerability of golang.org/x/crypto
- Dominant language
- Go
- Stars
- 3.3k
- Forks
- 680
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 14
Description
## 🚨 Security Vulnerability Alert: CVE-2026-56854 in `golang.org/x/crypto`
A security scanner has detected a **High-severity vulnerability** in the project's Go dependencies.
### 🛡️ Vulnerability Details
* **Vulnerable Package:** `golang.org/x/crypto`
* **Current Version:** `v0.54.0`
* **Fixed Version:** `v0.55.0`
* **CVE Identifier:** CVE-2026-56854 / CVE-2026-56855
* **Severity:** **7.5 / 10 (High)**
### 💥 Impact
The vulnerability allows a malicious peer or traffic manipulation during cryptographic workflows (such as SSH channel establishment or key processing) to trigger unexpected behavior, resource exhaustion, or server panic.
### 🛠️ Remediation Steps
Please upgrade the affected package to the patched version by running the following commands in the root directory:
```bash
# Update the dependency to the safe version
go get golang.org/x/crypto@v0.55.0
# Tidy up go.mod and go.sum files
go mod tidy
```
### 📋 Definition of Done
- [ ] Dependency updated to `v0.55.0` or higher in `go.mod`
- [ ] Application builds successfully
- [ ] Security scanner pass / No longer flagging `golang.org/x/crypto@v0.54.0`
Contributor guide
Research direction
From the repository root, inspect go.mod and go.sum, then run the issue's go get command for golang.org/x/crypto@v0.55.0 followed by go mod tidy. Verify that go.mod uses v0.55.0 or higher, the application builds successfully, and the security scanner no longer flags v0.54.0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 90/100