5.3
Medium
CVE-2025-58181 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request,…
Description
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh 0.45 | earliest → < 0.45.0 | 0.45.0 |
References
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/crypto/ssh
The 15 CVEs of golang.org/x/crypto/ssh →
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established
7.5
High
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
7.5
High
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
7.5
High
CVE-2026-46595
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
10.0
Critical