golang/crypto

Scanned on May 13, 2026

Risk score/ 100

High risk

Summary

The golang/crypto repository contains critical cryptographic vulnerabilities including the use of broken RC2 cipher and quantum-vulnerable Ed25519 signature algorithms. These findings pose significant risks to long-term data confidentiality and authentication integrity in a post-quantum threat landscape.

Critical

High

Medium

Low

Top findings

CriticalRC2
pkcs12/internal/rc2/bench_test.go:5
Raw evidence
```
package rc2
```
HighEd25519 / EdDSA
ed25519/ed25519_test.go:8
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA
Raw evidence
```
ed25519std "crypto/ed25519"
```
HighEd25519 / EdDSA
ed25519/ed25519_test.go:18
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA
Raw evidence
```
sig := ed25519.Sign(private, message)
```
HighEd25519 / EdDSA
ed25519/ed25519_test.go:19
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA
Raw evidence
```
if !ed25519.Verify(public, message, sig) {
```
HighEd25519 / EdDSA
ed25519/ed25519_test.go:11
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA
Raw evidence
```
"golang.org/x/crypto/ed25519"
```

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan