Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GO-2026-5932 applies to the golang.org/x/crypto/openpgp packages (openpgp, openpgp/packet, openpgp/armor, openpgp/clearsign, openpgp/errors, openpgp/elgamal and openpgp/s2k), which upstream has marked unmaintained and for which no fixed version exists. The advisory therefore matches on the golang.org/x/crypto module as a whole. dozzle links golang.org/x/crypto v0.57.0 but does not include any of the openpgp packages, so the vulnerable code is absent from the shipped binary rather than present but unreachable: the Go linker omits packages that are never referenced. Verified on the built artifact for both architectures. /usr/bin/dozzle has an intact symbol table, 95221 symbols on x86_64 and 94927 on aarch64, of which 114 (x86_64) and 102 (aarch64) come from golang.org/x/crypto, all in cryptobyte, cryptobyte/asn1, chacha20, chacha20poly1305, internal/poly1305, bcrypt, blowfish and pbkdf2. Zero symbols come from any golang.org/x/crypto/openpgp package on either architecture.