Vulnerability GO-2026-5013
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 22, 2026 at 02:08 AM UTC
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
<0.52.0
<0.52.0
Summary
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Details
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
<0.56.0 GO-2026-6354
<0.56.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
<0.56.0 GO-2026-6355
<0.56.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
<0.55.0 GO-2026-6303
<0.55.0 GO-2026-6303
Unknown
4 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
<0.58.1-0.20261009181718-2f1f834330b2 GO-2026-5932
<0.58.1-0.20261009181718-2f1f834330b2 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
<0.52.0 GHSA-x527-x647-q7gg
<0.52.0 GHSA-x527-x647-q7gg
Impacted packages
Timeline
Published
5 months ago
May 22, 2026 at 02:08 AM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
1 hour ago
November 13, 2026 at 07:12 PM UTC