~ / search / GHSA-78mq-xcr3-xm33

GHSA-78mq-xcr3-xm33

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-39835

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/crypto < 0.52.0 0.52.0

Details

As written in the advisory (Markdown source, shown as plain text).

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

References

External links from the advisory. They lead to third-party sites.