~ / search / GHSA-45gg-vh54-h5m9

GHSA-45gg-vh54-h5m9

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-39828

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/crypto < 0.52.0 0.52.0

Details

As written in the advisory (Markdown source, shown as plain text).

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

References

External links from the advisory. They lead to third-party sites.