9.1
Critical
CVE-2026-39831 The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did…
Description
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh 0.52 | earliest → < 0.52.0 | 0.52.0 |
Other CVEs of golang.org/x/crypto/ssh
The 15 CVEs of golang.org/x/crypto/ssh →
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established
7.5
High
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
7.5
High
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
7.5
High
CVE-2026-39834
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal…
9.1
Critical