Getting CVE Triggers for x/crypto/ssh - may apply to other packages

Problem Statement

Users attempting to deploy Coder 2.34.5 are blocked by CVE-2026-46595 in the x/crypto/ssh package. Upgrading to 2.34.6 does not resolve the issue, and a timeline for a fix is requested.

Root Cause

The CVE is triggered by the x/crypto/ssh@v0.52.0 dependency in Coder 2.34.5. The next release (likely 2.34.6 or later) will update this to v0.54.0. The issue may be a false positive if the scanner is misinterpreting the replace directive in go.mod with a timestamp from 20231128, which is used by Coder when importing/forking upstream repository and replacing the version with a pseudo version number/timestamp.

Verify the actual release/version in an environment with both 'go' and 'coder' binary:

go version -m /usr/local/bin/coder | grep "golang.org/x/crypto"
dep golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
# Main and the 'next release' will contain 0.54.0 or later.

Solution if you've confirmed an older package being present

Upgrade to the next Coder release (expected to include x/crypto/ssh@v0.54.0). Verify with your security scanner that the CVE is not a false positive related to the replace directive in go.mod.

Steps to Resolve

1. Monitor the Coder release channel for the next version (likely 2.34.6 or later) that includes x/crypto/ssh@v0.54.0.

2. Once available, upgrade to the new version to resolve the CVE.

3. If the CVE is a false positive, consult with your security team to adjust scanner configurations or verify the replace directive in go.mod.

Here’s how we suggest you proceed:

1. Monitor for the next Coder release (expected to include improved security for known issues).

2. Upgrade to the new version once available to resolve the CVE.

3. Verify with your security team if the CVE is a false positive, potentially caused by the replace directive in go.mod with a timestamp from 20231128. Adjust scanner configurations if needed.