Package
elastic-agent-fips-8.19
Component
golang.org/x/crypto
Latest update
Fixed version
8.19.20-r1
Aliases
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
8.19.20-r1Status
Impact
elastic-agent-fips 8.19 is flagged for GO-2026-5932 via its golang.org/x/crypto dependency (v0.54.0), specifically the golang.org/x/crypto/openpgp package. GO-2026-5932 is not a fixable code vulnerability: the Go vulnerability database records it as a deprecation advisory for golang.org/x/crypto/openpgp, which the upstream maintainers describe as unmaintained and unsafe by design. Its affected range covers all versions of golang.org/x/crypto with no fixed version, so upgrading the dependency cannot remediate it. Remediation requires the upstream Elastic Agent project to stop using golang.org/x/crypto/openpgp and migrate to a maintained OpenPGP implementation. Pending that upstream change, this is tracked as pending-upstream-fix. References: https://pkg.go.dev/vuln/GO-2026-5932 , https://go.dev/issue/44226 .
Batch: 2026-08-27-A
Status
Fixed version
8.19.20-r0Status
Impact
This package is affected by GO-2026-5932 through its golang.org/x/crypto/openpgp dependency and will need to be updated to stop using that dependency to remediate GO-2026-5932. GO-2026-5932 is not a specific code vulnerability but a call-to-action in which golang.org/x/crypto/openpgp maintainers describe the dependency as "unsafe by design", "not maintained", and "should not be used".
Status
Impact
Govulncheck found vulnerable symbols in Go binary at usr/share/elastic-agent/data/elastic-agent-35f53d/elastic-agent.
Status