GHSA-j5w8-q4qc-rx2x

ghsaUSosv

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

view advisory published 2025-11-19Licence: CC-BY-4.0

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-58181US	—	0.60% (48th)	—	2025-11-19
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/721961WEB
https://go.dev/issue/76363WEB
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZAWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-58181ADVISORY
https://pkg.go.dev/vuln/GO-2025-4134WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan