GO-2025-4134

vendorUSosv

Unbounded memory consumption in golang.org/x/crypto/ssh

view advisory published 2025-11-19Licence: per source

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-58181US	—	0.60% (48th)	—	2025-11-19
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/721961FIX
https://go.dev/issue/76363REPORT
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZAADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan