Summary

The current strfmt package depends on go.mongodb.org/mongo-driver v1.17.6, which references golang.org/x/crypto v0.26.0. This version is affected by CVE-2024-45337 (CVSS 9.1 Critical - SSH authorization bypass vulnerability).

While Go's MVS (Minimum Version Selection) resolves to newer crypto versions when users have direct requirements, many security scanning tools (Vanta, Snyk, Trivy, etc.) flag the v0.26.0 reference in the dependency graph as a vulnerability, causing false positives for downstream users.

Current State

github.com/go-openapi/strfmt@v0.25.0
└── go.mongodb.org/mongo-driver@v1.17.6
    └── golang.org/x/crypto@v0.26.0  ❌ (vulnerable, fix requires v0.31.0+)

Proposed Solution

Update to mongo-driver v2 which uses a patched crypto version:

go.mongodb.org/mongo-driver/v2@v2.4.1
└── golang.org/x/crypto@v0.33.0  ✅ (patched)

Impact

This affects all downstream projects using strfmt for OpenAPI validation. Security scanners flag CVE-2024-45337 even though:

• Go MVS may resolve to a newer crypto version at runtime
• The vulnerable SSH code path may not be reachable
• govulncheck reports no vulnerabilities

However, many organizations require clean security scans for compliance (SOC2, etc.), and this transitive reference causes audit failures.

Vulnerability Details

• CVE: CVE-2024-45337
• Go Advisory: GO-2024-3321
• Severity: Critical (CVSS 9.1)
• Affected: golang.org/x/crypto < v0.31.0
• Fixed: golang.org/x/crypto v0.31.0+
• Type: Authorization bypass via SSH PublicKeyCallback misuse

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45337
• https://pkg.go.dev/vuln/GO-2024-3321
• x/crypto/ssh: misuse of ServerConfig.PublicKeyCallback may cause authorization bypass golang/go#70779

Environment

• strfmt version: v0.25.0
• mongo-driver version: v1.17.6
• Go version: 1.24.x

Thank you for maintaining this package!