Package
elastic-otel-collector-9.4
Component
golang.org/x/crypto
Latest update
Aliases
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
elastic-agent is affected by GO-2026-5932 through its use of the golang.org/x/crypto/openpgp package. GO-2026-5932 is not a specific code vulnerability with a patched release; it is an upstream advisory stating that golang.org/x/crypto/openpgp is unmaintained and unsafe by design and should no longer be used. The advisory applies to all versions of golang.org/x/crypto (no fixed version exists), so no dependency-version upgrade can remediate it. elastic-agent imports this package in its upgrade-artifact verifier to check PGP signatures on downloaded artifacts, and the vulnerable symbols are reachable in the built binary. Remediation requires the upstream project to stop importing golang.org/x/crypto/openpgp — for example, by migrating to a maintained OpenPGP implementation such as github.com/ProtonMail/go-crypto/openpgp. The latest 9.4.x release still imports it and upstream has not yet removed the dependency, so this remains pending an upstream fix. References: https://pkg.go.dev/vuln/GO-2026-5932 and https://go.dev/issue/44226.
Batch: 2026-08-27-A
Status
Impact
This package is affected by GO-2026-5932 through its golang.org/x/crypto/openpgp dependency and will need to be updated to stop using that dependency to remediate GO-2026-5932. GO-2026-5932 is not a specific code vulnerability but a call-to-action in which golang.org/x/crypto/openpgp maintainers describe the dependency as "unsafe by design", "not maintained", and "should not be used".
Status