{"grype_matches":[{"artifact":{"id":"42c416cf9f543fb7","cpes":["cpe:2.3:a:golang:crypto:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.58.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.58.0","type":"go-module","version":"v0.58.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=","mainModule":"github.com/nats-io/nats-server/v2","architecture":"amd64","goCompiledVersion":"go1.27.4"},"locations":[{"path":"/nats-server","layerID":"sha256:11d1e885cbdf2ee0c9d502e32428f630e0effaf8baf92c18a53996327de1c456","accessPath":"/nats-server","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.58.1-0.20261009181718-2f1f834330b2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"<0.58.1-0.20261009181718-2f1f834330b2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.58.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"fixed","versions":["0.58.1-0.20261009181718-2f1f834330b2"],"available":[{"date":"2026-10-09","kind":"release","version":"0.58.1-0.20261009181718-2f1f834330b2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81227"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]}],"grade":"A","score":"100.00","as_of":"2026-11-14T08:37:15.258Z","grype_db_version":"2026-11-13T15:40:34.000Z"}