GO-2025-3487

Potential denial of service in golang.org/x/crypto

En bref

Publiée: 2025-02-26 02:51 UTC
Mise à jour: 2026-02-05 01:28 UTC
CVE: CVE-2025-22869
Alias: GHSA-hcg3-q754-cr77

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Paquets affectés

Paquet	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.35.0

Références

https://go.dev/cl/652135 FIX
https://go.dev/issue/71931 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database