-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the golang.org/x/crypto/ssh package, where the server does not properly validate GSSAPI authentication requests. Specifically, the parseGSSAPIPayload function reads the number of mechanisms from the request payload and uses this value to allocate memory. An attacker can craft a request with an excessively large number of mechanisms, causing the server to attempt to allocate an unbounded amount of memory, which leads to a denial of service. The patch addresses this by introducing a reasonable upper limit on the number of mechanisms that can be specified in a request, thus preventing the unbounded memory allocation.
ssh.parseGSSAPIPayloadssh/ssh_gss.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.45.0 | 0.45.0 |
GoGoOngoing coverage of React2Shell