Fluid Attacks Database

Description

golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	golang.org/x/crypto	>=0 <0.52.0	0.52.0
debian 12	golang-go.crypto	=1:0.10.0-1 \|\| =1:0.12.0-1 \|\| =1:0.13.0-1 \|\| =1:0.14.0-1 \|\| =1:0.16.0-1 \|\| =1:0.17.0-1 \|\| =1:0.18.0-1 \|\| =1:0.19.0-1 \|\| =1:0.21.0-1 \|\| =1:0.22.0-1 \|\| =1:0.23.0-1 \|\| =1:0.24.0-1 \|\| =1:0.24.0-2 \|\| =1:0.25.0-1 \|\| =1:0.25.0-1~bpo12+1 \|\| =1:0.33.0-1~exp1 \|\| =1:0.36.0-1~exp1 \|\| =1:0.4.0-1 \|\| =1:0.41.0-1~exp1 \|\| =1:0.42.0-1 \|\| =1:0.42.0-1~exp1 \|\| =1:0.42.0-2 \|\| =1:0.42.0-3 \|\| =1:0.42.0-4 \|\| =1:0.43.0-1 \|\| =1:0.43.0-2 \|\| =1:0.45.0-1 \|\| =1:0.46.0-1 \|\| =1:0.47.0-1 \|\| =1:0.50.0-1 \|\| =1:0.52.0-1 \|\| =1:0.52.0-1~bpo13+1 \|\| =1:0.53.0-1 \|\| =1:0.54.0-1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1	-
debian 14	golang-go.crypto	=1:0.25.0-1 \|\| =1:0.33.0-1~exp1 \|\| =1:0.36.0-1~exp1 \|\| =1:0.41.0-1~exp1 \|\| =1:0.42.0-1 \|\| =1:0.42.0-1~exp1 \|\| =1:0.42.0-2 \|\| =1:0.42.0-3 \|\| =1:0.42.0-4 \|\| =1:0.43.0-1 \|\| =1:0.43.0-2 \|\| =1:0.45.0-1 \|\| =1:0.46.0-1 \|\| =1:0.47.0-1 \|\| =1:0.50.0-1 \|\| =1:0.52.0-1~bpo13+1 \|\| >=0 <1:0.52.0-1	1:0.52.0-1
debian 13	golang-go.crypto	=1:0.25.0-1 \|\| =1:0.33.0-1~exp1 \|\| =1:0.36.0-1~exp1 \|\| =1:0.41.0-1~exp1 \|\| =1:0.42.0-1 \|\| =1:0.42.0-1~exp1 \|\| =1:0.42.0-2 \|\| =1:0.42.0-3 \|\| =1:0.42.0-4 \|\| =1:0.43.0-1 \|\| =1:0.43.0-2 \|\| =1:0.45.0-1 \|\| =1:0.46.0-1 \|\| =1:0.47.0-1 \|\| =1:0.50.0-1 \|\| =1:0.52.0-1 \|\| =1:0.52.0-1~bpo13+1 \|\| =1:0.53.0-1 \|\| =1:0.54.0-1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1	-
rpm rhel9	podman	<6:5.8.2-4.el9_8	6:5.8.2-4.el9_8
rpm rhel9	gvisor-tap-vsock	-	-
rpm rhel9	buildah	<2:1.43.1-3.el9_8	2:1.43.1-3.el9_8
rpm rhel10	gvisor-tap-vsock	-	-
rpm rhel10	buildah	<2:1.43.1-3.el10_2	2:1.43.1-3.el10_2
rpm rhel10	podman	<7:5.8.2-4.el10_2	7:5.8.2-4.el10_2

1-10 of 11

Aliases

1. CVE-2026-398352. NVD-2026-398353. OSV-2026-398354. OSV-DEBIAN-2026-398355. GHSA-78mq-xcr3-xm336. GCVE-2026-398357. access.redhat.com8. access.redhat.com9. access.redhat.com10. access.redhat.com11. access.redhat.com12. access.redhat.com13. access.redhat.com14. access.redhat.com15. access.redhat.com16. access.redhat.com17. access.redhat.com18. access.redhat.com19. access.redhat.com20. access.redhat.com21. access.redhat.com22. access.redhat.com23. access.redhat.com24. access.redhat.com25. access.redhat.com26. access.redhat.com27. access.redhat.com28. access.redhat.com29. ACCESS-CVE-2026-3983530. SECURITY-cve-2026-39835.json31. access.redhat.com32. access.redhat.com33. access.redhat.com34. access.redhat.com35. access.redhat.com36. access.redhat.com37. access.redhat.com38. access.redhat.com39. access.redhat.com40. access.redhat.com41. access.redhat.com42. access.redhat.com43. access.redhat.com44. access.redhat.com45. access.redhat.com46. access.redhat.com47. access.redhat.com48. access.redhat.com49. access.redhat.com50. access.redhat.com51. access.redhat.com52. access.redhat.com53. access.redhat.com54. access.redhat.com55. access.redhat.com56. access.redhat.com57. access.redhat.com58. access.redhat.com59. access.redhat.com60. access.redhat.com61. SECURITY-TRACKER-CVE-2026-39835

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=24806802. https://go.dev/cl/7816603. https://go.dev/issue/795634. https://groups.google.com/g/golang-announce/c/a082jnz-LvI5. https://pkg.go.dev/vuln/GO-2026-5015

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.