Zennoxa Shield
Rules / Go
SHIELD-GO-003

Weak cryptographic hash (MD5)

highGoCWE-327CVSS 7.4

What it detects

MD5 is cryptographically broken and should not be used for security.

How to fix

Use crypto/sha256 or crypto/sha512 instead of crypto/md5.

Vulnerable — Shield flags thishash.go
package auth

import (
	"crypto/md5"
	"encoding/hex"
)

func FingerprintToken(token []byte) string {
	sum := md5.Sum(token) // MD5 is broken: collisions are practical
	return hex.EncodeToString(sum[:])
}
Fixed — scans cleanhash.go
package auth

import (
	"crypto/sha256"
	"encoding/hex"
)

func FingerprintToken(token []byte) string {
	sum := sha256.Sum256(token)
	return hex.EncodeToString(sum[:])
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-003: Weak cryptographic hash (MD5) — Zennoxa Shield