Golang.Org/X/Crypto/Ssh
Approved changes feed: RSS · Atom
cpe:2.3:a:golang.org/x/crypto:golang.org/x/crypto/ssh:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Golang.Org/X/Crypto (cd90b48b-9649-5b19-9ae4-702ade470940) |
|---|---|
| Product | Golang.Org/X/Crypto/Ssh (96918f48-ebfe-53fb-930f-ccb044b19419) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46597 |
vulnerable | 2026-06-08 08:05:12.100022 |
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Published: 2026-05-22T02:31:26.754Z
Updated: 2026-05-22T14:08:27.674Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-46595 |
vulnerable | 2026-06-08 08:05:12.099794 |
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Published: 2026-05-22T02:31:27.894Z
Updated: 2026-08-28T12:04:28.367Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39835 |
vulnerable | 2026-06-08 08:01:17.069604 |
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
Published: 2026-05-22T02:31:26.982Z
Updated: 2026-08-28T12:04:16.986Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39834 |
vulnerable | 2026-06-08 08:01:17.069452 |
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Published: 2026-05-22T02:31:27.540Z
Updated: 2026-05-22T18:50:51.339Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39831 |
vulnerable | 2026-06-08 08:01:17.066676 |
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Published: 2026-05-22T02:31:27.436Z
Updated: 2026-05-22T18:52:08.344Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39830 |
vulnerable | 2026-06-08 08:01:17.066439 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39829 |
vulnerable | 2026-06-08 08:01:17.066176 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39828 |
vulnerable | 2026-06-08 08:01:17.065813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39827 |
vulnerable | 2026-06-08 08:01:17.065589 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58181 |
vulnerable | 2026-06-08 07:35:17.414993 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22869 |
vulnerable | 2026-06-08 07:10:54.933644 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45337 |
vulnerable | 2026-06-08 06:48:05.934807 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.