CVE-2026-46598

What it actually does

This flaw allows malformed Ed25519 private-key wire data to be converted into a crypto/ed25519.PrivateKey value that is structurally invalid. When application code later uses that key for operations such as signing or deriving the public key, the Go crypto implementation can panic. In services that parse attacker-controlled key material and do not recover from panics at the request boundary, this can terminate a request handler, worker, or the whole process, resulting in denial of service. The issue does not indicate confidentiality loss, integrity compromise, or code execution based on the supplied details.

Why it matters to the business

An attacker may be able to crash Go-based services that accept or process Ed25519 private-key material from untrusted sources, causing intermittent outages, failed authentication or signing workflows, degraded availability, and operational noise. The CVSS score indicates moderate severity with low attack complexity and no authentication required, but EPSS is currently low, there is no known CISA KEV listing, and no public exploit maturity is reported; organizations should still remediate because internet-facing parsers can be repeatedly triggered once a crash condition is understood.

How an attack unfolds

An attacker identifies a Go application or service path that accepts serialized key material, configuration bundles, protocol messages, or other wire-format inputs that may contain an Ed25519 private key. The attacker submits a crafted payload where the Ed25519 private-key bytes are malformed but still pass through parsing or casting logic into an ed25519.PrivateKey object. The vulnerable code stores or forwards that object until a later operation attempts to use it, such as signing a message, authenticating a handshake, or deriving the public key. At that point, the Go crypto code encounters invalid key structure and panics. If the application lacks panic recovery or if the panic occurs in a critical process, the service can crash or become unavailable. Repeating the request can create a sustained denial-of-service condition.

How to fix it

Upgrade the affected Go crypto dependency or Go toolchain to a version that includes the vendor fix as soon as an official fixed version is available for the package in use. Because no exact fixed version was provided in the input, track the relevant Go security advisory and update golang.org/x/crypto and/or the Go standard library dependency through normal dependency management. In addition, defensively validate Ed25519 private-key material before use: require the exact expected private-key length, reject malformed wire encodings, avoid direct casting of untrusted bytes into ed25519.PrivateKey, and prefer safe parsing APIs that perform validation. Add panic recovery around request handlers and background workers that process untrusted cryptographic material so a malformed input cannot terminate the entire service. Apply rate limiting and input-size limits to endpoints that parse keys or cryptographic objects.

How to confirm the fix worked

Confirm that all Go modules and binaries have been rebuilt with a non-vulnerable version of the affected crypto package once available. Use `go version -m <binary>` and `go list -m all` to identify embedded Go versions and golang.org/x/crypto versions. Review code for direct conversions such as `ed25519.PrivateKey(data)` or equivalent casts from untrusted wire bytes, and verify that length and format checks occur before any call to `Sign`, `Public`, or related key-use operations. Test with malformed Ed25519 private-key encodings in a controlled environment and confirm the application rejects the input with a normal error response rather than logging a panic or terminating. Validate that process supervisors, health checks, and panic recovery prevent a single malformed request from taking down the service.

Typical attack path

1. Find a Go-based service, API, protocol endpoint, or library consumer that accepts Ed25519 private-key material or serialized key objects from remote input.
2. Send crafted wire-format input containing malformed Ed25519 private-key bytes that are accepted or cast into an ed25519.PrivateKey value.
3. Trigger application behavior that uses the malformed key, such as signing, authentication, certificate handling, or public-key derivation.
4. Cause the crypto operation to panic when it validates or operates on the malformed private key.
5. Repeat the malformed request to crash workers or processes and degrade service availability.

How to detect it

Look for evidence of panic-driven denial of service in application logs, container logs, process supervisor events, and crash reporting systems. Relevant sources include Go application stderr/stdout, web/API access logs, reverse proxy logs, Kubernetes pod restart events, systemd journal entries, container runtime events, core dumps, and APM error traces. Search for panic stack traces involving crypto/ed25519, ed25519.PrivateKey, Sign, or Public methods near requests that import, parse, upload, or process keys. Correlate panics with repeated requests from the same source IP, user agent, API client, or unauthenticated endpoint. Also review restart loops, elevated 5xx responses, abrupt connection resets, and crashes immediately after key-processing requests. There are no known threat actors, KEV exploitation, ransomware use, or public exploit artifacts provided, so detection should focus on behavioral crash indicators rather than campaign-specific infrastructure.

• panic: ed25519: bad private key length
• ed25519: bad private key length
• crypto/ed25519.PrivateKey.Sign
• crypto/ed25519.PrivateKey.Public
• crypto/ed25519.sign
• panic: runtime error
• goroutine
• SIGABRT
• systemd: Main process exited
• Back-off restarting failed container
• CrashLoopBackOff
• container exited with code 2
• panic serving
• net/http.(*conn).serve

What your security team should do

• Inventory Go applications and services that import crypto/ed25519 or golang.org/x/crypto and process externally supplied key material.
• Prioritize internet-facing or multi-tenant services that parse private keys, SSH keys, certificates, signed messages, or cryptographic configuration supplied by users or peers.
• Update affected Go crypto dependencies and rebuild/redeploy statically linked Go binaries when an official fixed version is available.
• Ask engineering teams to search for unsafe casts from byte slices to ed25519.PrivateKey and add strict validation before key use.
• Add or verify panic recovery at HTTP/RPC/message-processing boundaries so malformed input cannot terminate a process.
• Monitor logs for Ed25519 private-key panics and unexplained process restarts, especially following requests to key import, authentication, signing, SSH, certificate, or configuration endpoints.
• Because this is not currently in CISA KEV and EPSS is low, treat it as a prioritized availability hardening issue rather than an emergency ransomware-driven patch, unless exposed services show crash evidence.