5.3
Medium
CVE-2026-46598 For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic…
Description
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh/agent 0.52 | earliest → < 0.52.0 | 0.52.0 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/crypto/ssh/agent
The 5 CVEs of golang.org/x/crypto/ssh/agent →
CVE-2026-39833
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never…
9.1
Critical
CVE-2026-39832
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not…
9.1
Critical
CVE-2025-47914
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the…
5.3
Medium
CVE-2025-47913
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the…
7.5
High