ClickHouse / ClickHouse/clickhouse-go

security: High-severity vulnerability of golang.org/x/crypto

Open Beginner friendly
#2,011 0 comments 0 reactions 0 assignees View on GitHub
bug needs triage
Dominant language
Go
Stars
3.3k
Forks
680
Avg merge
2d 3h
Merged PRs (30d)
14

Description

## 🚨 Security Vulnerability Alert: CVE-2026-56854 in `golang.org/x/crypto`

A security scanner has detected a **High-severity vulnerability** in the project's Go dependencies.

### 🛡️ Vulnerability Details
* **Vulnerable Package:** `golang.org/x/crypto`
* **Current Version:** `v0.54.0`
* **Fixed Version:** `v0.55.0`
* **CVE Identifier:** CVE-2026-56854 / CVE-2026-56855
* **Severity:** **7.5 / 10 (High)**

### 💥 Impact
The vulnerability allows a malicious peer or traffic manipulation during cryptographic workflows (such as SSH channel establishment or key processing) to trigger unexpected behavior, resource exhaustion, or server panic.

### 🛠️ Remediation Steps
Please upgrade the affected package to the patched version by running the following commands in the root directory:

```bash
# Update the dependency to the safe version
go get golang.org/x/crypto@v0.55.0

# Tidy up go.mod and go.sum files
go mod tidy
```

### 📋 Definition of Done
- [ ] Dependency updated to `v0.55.0` or higher in `go.mod`
- [ ] Application builds successfully
- [ ] Security scanner pass / No longer flagging `golang.org/x/crypto@v0.54.0`

Contributor guide

Open the contributing guide

Research direction

From the repository root, inspect go.mod and go.sum, then run the issue's go get command for golang.org/x/crypto@v0.55.0 followed by go mod tidy. Verify that go.mod uses v0.55.0 or higher, the application builds successfully, and the security scanner no longer flags v0.54.0.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
90/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.