GHSA-mpwr-8vm7-h73f

    Dashboard / Vulnerabilities / GHSA-mpwr-8vm7-h73f

    GHSA-mpwr-8vm7-h73f

    Published: 17 Aug 2026Last Modified: 10 Sept 2026
    Aliases:
    GO-2026-5052

    Summary: package pkcs12: Authentication bypass in Decode functions

    Details: `Decode`, `DecodeChain`, `DecodeTrustStore`, and `ToPEM` can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be tricked into accepting malicious PKCS#12 files. Users who only decode PKCS#12 files from trusted sources are not affected. Thanks to Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic) for finding and reporting the same issue in OpenSSL ([CVE-2026-34181](https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181)).

    References: https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f, https://github.com/SSLMate/go-pkcs12, https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181

    Affected packages

    Package

    Name: software.sslmate.com/src/go-pkcs12

    Purl: pkg:golang/software.sslmate.com/src/go-pkcs12

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.6.0
    Fixed -0.7.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-mpwr-8vm7-h73f | CVE-DB