Vulnerability GO-2026-5033
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 22, 2026 at 02:08 AM UTC
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
v0.1.0 - v0.51.0
v0.1.0 - v0.51.0
Summary
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
Details
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6354
v0.1.0 - v0.55.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6355
v0.1.0 - v0.55.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
v0.1.0 - v0.54.0 GO-2026-6303
v0.1.0 - v0.54.0 GO-2026-6303
Unknown
4 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
v0.1.0 - v0.58.0 GO-2026-5932
v0.1.0 - v0.58.0 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
Impacted packages
Timeline
Published
5 months ago
May 22, 2026 at 02:08 AM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
6 hours ago
November 14, 2026 at 01:12 PM UTC