Skip to main content
cve.nowby Sazabi
← Go
GoPackage

golang.org/x/crypto/ssh

15 known vulnerabilities (5 critical, 6 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 5 critical, 6 high, 4 medium
Registry
pkg.go.dev

Advisories 15

  • Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

    Affected: fixed in 0.56.0.

  • Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

    Affected: fixed in 0.56.0.

  • Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

    Affected: fixed in 0.55.0.

  • CVE-2026-46595Critical 10.0

    Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39834Critical 9.1

    Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39831Critical 9.1

    Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39830Critical 9.1

    Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39827Medium 6.5

    Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39835Medium 5.3

    Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2026-39828Medium 6.3

    Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

    Affected: fixed in 0.52.0.

  • CVE-2025-58181Medium 5.3

    Unbounded memory consumption in golang.org/x/crypto/ssh

    Affected: fixed in 0.45.0.

  • Potential denial of service in golang.org/x/crypto

    Affected: fixed in 0.35.0.

  • CVE-2024-45337Critical 9.1

    Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

    Affected: fixed in 0.31.0.