GHSA-j5w8-q4qc-rx2x

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

En bref

Publiée: 2025-11-19 23:01 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2025-58181
Alias: GO-2025-4134
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Paquets affectés

Paquet	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.45.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-58181 ADVISORY
https://go.dev/cl/721961 WEB
https://go.dev/issue/76363 WEB
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA WEB
https://pkg.go.dev/vuln/GO-2025-4134 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database