Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/crypto golang.org/x/crypto/ssh

Default version status: unaffected

  • 0 to < 0.52.0affected

References