GitHub Advisoryadvisory · Go

GHSA-f6x5-jh6r-wrfv golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

MEDIUM Published 2025-11-19 Modified 2025-11-20 Official page ↗
Aliases
CVE-2025-47914
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-125
Reviewed
2025-11-19

Affected packages

• Go golang.org/x/crypto: < 0.45.0 → fixed in 0.45.0

Description

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Related

Alias · CVE (1)

  • CVE-2025-47914 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the… vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References