DEBIAN-CVE-2026-32953
Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.
DEBIAN-CVE-2026-32953
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-32953
golang-github-tillitis-tkeyclient
Source reference: /affected/0/package/name
- Affected versions
- 1.1.0-2
Source reference:
/affected/0/versions1.2.0-1Source reference:
/affected/0/versions1.2.0-2Source reference:
/affected/0/versions1.2.0-2~exp0Source reference:
/affected/0/versions1.3.0-1Source reference:
/affected/0/versions1.3.1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
golang-github-tillitis-tkeyclient
Source reference: /affected/1/package/name
- Affected versions
- 1.1.0-2
Source reference:
/affected/1/versions1.2.0-1Source reference:
/affected/1/versions1.2.0-2Source reference:
/affected/1/versions1.2.0-2~exp0Source reference:
/affected/1/versions - Fixed versions
- 1.3.0-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-tillitis-tkeyclient",
"purl": "pkg:deb/debian/golang-github-tillitis-tkeyclient?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.1.0-2",
"1.2.0-1",
"1.2.0-2",
"1.2.0-2~exp0",
"1.3.0-1",
"1.3.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32953.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0-1"
}
]
}
],
"package": {
"name": "golang-github-tillitis-tkeyclient",
"purl": "pkg:deb/debian/golang-github-tillitis-tkeyclient?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.1.0-2",
"1.2.0-1",
"1.2.0-2",
"1.2.0-2~exp0"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32953.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56389 · Revision 1
- Added to Heist Feed
- Publisher date