5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32952

CVE-2026-32952: go-ntlmssp NTLM challenges can panic on malformed payloads

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32952

CVE-2026-32952:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/Azure/go-ntlmssp	go	< 0.1.1	0.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how the go-ntlmssp library parses NTLM challenge messages. An integer overflow vulnerability exists in the varField.ReadFrom function located in varfield.go. When parsing a field from the challenge, the code calculates the field's size by adding an offset and a length. Both are 32-bit integers. A remote attacker can craft a malicious challenge message with a large length value that, when added to the offset, overflows and wraps around to a small number. This bypasses the buffer size check. However, the subsequent memory slice operation uses the original, non-overflowed length, leading to a 'slice bounds out of range' panic and crashing the application, resulting in a denial of service.

The patch, identified in commit bd8579c18d41bf5d91a5f74b1117c958f635b866, fixes this by promoting the offset and length to 64-bit integers before addition and explicitly checking for a wraparound condition. The analysis identified two key functions:

varField.ReadFrom: This is the low-level function where the flawed integer arithmetic and subsequent panic occur. The patch directly modifies this function to add security checks.
NewAuthenticateMessage: This higher-level function is responsible for orchestrating the parsing of the challenge message. The new test case added in the patch directly calls this function to validate the fix, confirming it's a primary entry point for the vulnerable code path.

Vulnerable functions

varField.ReadFrom

varfield.go

The function `varField.ReadFrom` is vulnerable to an integer overflow. The original code calculated the end of a slice by adding `f.BufferOffset` and `f.Len` as 32-bit integers. A malicious NTLM challenge could provide values that cause this addition to overflow (wrap around), bypassing the length check. The subsequent slicing operation would then use the original, large length, causing a panic due to a 'slice out of bounds' error. The patch mitigates this by using 64-bit integers for the calculation and explicitly checking for overflow.

NewAuthenticateMessage

negotiator.go

The function `NewAuthenticateMessage` processes the NTLM challenge message. The patch adds a test case, `TestNewAuthenticateMessage_ChallengeTargetInfoOffsetOverflowNoPanics`, which specifically calls `NewAuthenticateMessage` with a malformed payload designed to trigger the integer overflow. This indicates that `NewAuthenticateMessage` is a key function in the execution path of the vulnerability, as it is responsible for parsing the malicious input that leads to the panic in `varField.ReadFrom`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.