# golang.org/x/crypto/ssh (Go) vulnerabilities

15 known vulnerabilities (5 critical, 6 high, 4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/golang.org/x/crypto/ssh

## Advisories (15)

### [CVE-2026-56855](https://cve.now/CVE-2026-56855): Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

- Severity: High 7.5
- Published: Sep 2, 2026
- Affected: fixed in 0.56.0.

### [CVE-2026-78662](https://cve.now/CVE-2026-78662): Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

- Severity: High 7.5
- Published: Sep 2, 2026
- Affected: fixed in 0.56.0.

### [CVE-2026-56854](https://cve.now/CVE-2026-56854): Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

- Severity: High 7.5
- Published: Aug 28, 2026
- Affected: fixed in 0.55.0.

### [CVE-2026-46595](https://cve.now/CVE-2026-46595): Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

- Severity: Critical 10.0
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39834](https://cve.now/CVE-2026-39834): Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

- Severity: Critical 9.1
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39831](https://cve.now/CVE-2026-39831): Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

- Severity: Critical 9.1
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39829](https://cve.now/CVE-2026-39829): Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

- Severity: High 7.5
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39830](https://cve.now/CVE-2026-39830): Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

- Severity: Critical 9.1
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39827](https://cve.now/CVE-2026-39827): Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

- Severity: Medium 6.5
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39835](https://cve.now/CVE-2026-39835): Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

- Severity: Medium 5.3
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-39828](https://cve.now/CVE-2026-39828): Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

- Severity: Medium 6.3
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2026-46597](https://cve.now/CVE-2026-46597): Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

- Severity: High 7.5
- Published: May 22, 2026
- Affected: fixed in 0.52.0.

### [CVE-2025-58181](https://cve.now/CVE-2025-58181): Unbounded memory consumption in golang.org/x/crypto/ssh

- Severity: Medium 5.3
- Published: Nov 19, 2025
- Affected: fixed in 0.45.0.

### [CVE-2025-22869](https://cve.now/CVE-2025-22869): Potential denial of service in golang.org/x/crypto

- Severity: High 7.5
- Published: Feb 26, 2025
- Affected: fixed in 0.35.0.

### [CVE-2024-45337](https://cve.now/CVE-2024-45337): Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

- Severity: Critical 9.1
- Published: Dec 11, 2024
- Affected: fixed in 0.31.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/golang.org/x/crypto/ssh
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.