# CVE-2026-42508

## Summary

- **CVE ID:** CVE-2026-42508
- **Severity:** HIGH
- **CVSS Score:** 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** N/A
- **Published:** May 22, 2026
- **Last Modified:** Sep 15, 2026

## Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

## Affected Products

- golang.org/x/crypto — golang.org/x/crypto/ssh/knownhosts (0)

## References

- [CNA](https://go.dev/issue/79568)
- [CNA](https://go.dev/cl/781220)
- [CNA](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [CNA](https://pkg.go.dev/vuln/GO-2026-5021)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-42508)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2480688)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23262)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23264)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26547)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26546)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35833)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36648)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37072)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37123)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36808)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36651)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36797)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37387)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40138)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40118)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40262)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41019)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41064)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40945)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41036)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41031)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41066)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42146)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43692)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43052)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:46885)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47737)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47735)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49944)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51033)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51288)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:52857)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:52910)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54400)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57194)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59467)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60520)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61314)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65126)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66521)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66022)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67450)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 7.31%
- **EPSS Percentile:** 94.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._