GitHub Advisoryadvisory · Go

GHSA-j5w8-q4qc-rx2x golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

MEDIUM Published 2025-11-19 Modified 2025-11-19 Official page ↗
Aliases
CVE-2025-58181
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2025-11-19

Affected packages

• Go golang.org/x/crypto: < 0.45.0 → fixed in 0.45.0

Description

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Related

Alias · CVE (1)

  • CVE-2025-58181 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References