[AV-142867] Fix critical issue in x/crypto via minor version upgrade from 0.17.0 to 0.52.0

[aikido-autofix]

Jira

• AV-142867

Description

Upgrade golang.org/x/crypto to fix critical SSH security vulnerabilities: authorization bypass, resource exhaustion DoS, FIDO key verification bypass, integer overflow, and certificate revocation bypass.

✅ 10 CVEs resolved by this upgrade, including 10 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-11022	🚨 CRITICAL	[golang.org/x/crypto] Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
AIKIDO-2026-11025	🚨 CRITICAL	[golang.org/x/crypto] A malicious SSH peer can send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop and causing a resource leak that cannot be released by Close(). This results in a denial of service through goroutine exhaustion.
AIKIDO-2026-11029	🚨 CRITICAL	[golang.org/x/crypto] The Verify() method for FIDO/U2F security keys fails to check the User Presence flag, allowing signatures generated without physical touch to be accepted. This enables unauthorized unattended use of hardware security keys, bypassing intended security controls.
AIKIDO-2026-11028	🚨 CRITICAL	[golang.org/x/crypto] An integer overflow in SSH channel write operations causes an infinite loop when writing data larger than 4GB in a single call, resulting in denial of service through empty packet transmission. The vulnerability has been fixed by using int64 for size comparisons to prevent truncation.
AIKIDO-2026-11027	🚨 CRITICAL	[golang.org/x/crypto] Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @Revoked.
AIKIDO-2026-11034	🚨 CRITICAL	[golang.org/x/crypto] A keyring implementation silently ignored the ConfirmBeforeUse constraint on keys, allowing unauthorized signing without prompts or caller notification. This has been fixed to return an error when unsupported constraints are requested.
AIKIDO-2026-11033	🚨 CRITICAL	[golang.org/x/crypto] A vulnerability in SSH key agent constraint handling fails to serialize destination restriction extensions when forwarding keys to remote agents, allowing unrestricted key usage on remote hosts. The fix ensures constraint extensions are properly serialized and unsupported constraints are rejected rather than silently ignored.
CVE-2026-39830	🚨 CRITICAL	[golang.org/x/crypto] A malicious SSH peer can send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop and causing a resource leak that cannot be released by Close(). This results in a denial of service through goroutine exhaustion.
CVE-2026-39831	🚨 CRITICAL	[golang.org/x/crypto] The Verify() method for FIDO/U2F security keys fails to check the User Presence flag, allowing signatures generated without physical touch to be accepted. This enables unauthorized unattended use of hardware security keys, bypassing intended security controls.
CVE-2026-39834	🚨 CRITICAL	[golang.org/x/crypto] An integer overflow in SSH channel write operations causes an infinite loop when writing data larger than 4GB in a single call, resulting in denial of service through empty packet transmission. The vulnerability has been fixed by using int64 for size comparisons to prevent truncation.

Pull Request Category

• 🚀 New Functionality
• 🐛 Bug Fix
• 📚 Documentation
• ♻️ Refactor
• 🚄 Performance Improvements
• ⏪ Revert
• 🏛️ Infrastructure
• 📦 Release
• ⚙️ Build, Merge, CI or CD

Testing Approach

How was this change tested and do you have evidence?

• Unit
• Functional with cbclocal
• E2E Tests
• Sandbox
• Una

🔗 Related Tasks

• https://couchbasecloud.atlassian.net/browse/AV-142867

[Copilot]

🟡 Changes recommended

The go 1.25.0 directive likely breaks existing builds that use Go 1.21 (e.g., the provided Dockerfile) and should be aligned or separated from the dependency-only security upgrade.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the module dependency set to remediate reported security vulnerabilities in transitive SSH-related packages by upgrading golang.org/x/crypto (and associated x/* modules) to newer versions.

Changes:

• Upgraded golang.org/x/crypto from v0.17.0 to v0.52.0 (indirect), along with related golang.org/x/net, golang.org/x/sys, and golang.org/x/text versions.
• Updated go.sum to reflect the new module versions and checksums.
• Bumped the go directive in go.mod to go 1.25.0 (not mentioned in the PR description, and may conflict with existing build tooling).

File summaries

File	Description
go.mod	Updates go directive and upgrades golang.org/x/* indirect requirements.
go.sum	Refreshes checksums for upgraded golang.org/x/* module versions.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[allabalakrishna9]

Good catch on the Dockerfile — fixed in 277a6c9, which bumps the builder stage to golang:1.25.

Taking the opposite route to the one suggested, though, because pinning the go directive back to 1.21.3 would break the build rather than fix it. The go 1.25.0 bump isn't a discretionary toolchain change — every module in this PR declares it:

Module	go directive in its own go.mod
golang.org/x/crypto@v0.52.0	go 1.25.0
golang.org/x/net@v0.54.0	go 1.25.0
golang.org/x/sys@v0.45.0	go 1.25.0
golang.org/x/text@v0.37.0	go 1.25.0

Keeping go 1.21.3 would fail with a "module requires go >= 1.25.0" error.

Staying on Go 1.21 isn't a useful alternative either. The newest x/crypto that still supports it is v0.33.0 (v0.34.0 moves to go 1.23.0), and per OSV that leaves ~37 of the 39 known advisories in place, versus 4 at v0.52.0.

So the toolchain bump is the price of the remediation, and the Dockerfile needed to move with it.

[Copilot]

🔵 Needs a closer look

It includes a Go toolchain bump and large transitive golang.org/x/* upgrades that should be validated in the full build/release environment before approval.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[allabalakrishna9]

Superseded by #20, which consolidates this PR with its sibling.

#18 (x/crypto) and #19 (x/net) both edit go.mod/go.sum and were each generated against main with no knowledge of the other. #18 set x/crypto to v0.52.0, #19 set it to v0.51.0 — 4 known advisories versus 30. Whichever merged second would have rewritten the other, and in the #18-then-#19 order that meant a downgrade re-introducing roughly 26 advisories.

#20 takes both bumps together, at higher versions than either PR proposed:

Module	This PR	#20
golang.org/x/net	v0.55.0 (#19) / unchanged (#18)	v0.58.0 — 0 known advisories
golang.org/x/crypto	v0.52.0 (#18) / v0.51.0 (#19)	v0.55.0 — 3 known advisories

It also carries the golang:1.25 Dockerfile fix from the Copilot reviews on both PRs, and is verified with go build ./....

Closing this one. No work is lost — AV-142867 and AV-142868 both remain open and are linked from #20.