CVE-2026-46597
High
Published: 22 May 2026
Published
22 May 2026
Modified
28 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.0038
29.5th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-46597 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Golang Crypto. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31388
Vulnerability details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?
Malformed AES-GCM packets trigger server panic, directly enabling remote application exploitation for endpoint DoS.
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
Affected Assets
golang
crypto
≤ 0.52.0
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.