GO-2025-3487

Potential denial of service in golang.org/x/crypto

At a glance

Published: 2025-02-26 02:51 UTC
Updated: 2026-02-05 01:28 UTC
CVE: CVE-2025-22869
Aliases: GHSA-hcg3-q754-cr77

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.35.0

References

https://go.dev/cl/652135 FIX
https://go.dev/issue/71931 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database