Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the golang.org/x/crypto/ssh package, specifically within the CertChecker implementation. The CheckHostKey and Authenticate methods of CertChecker were missing crucial validation. These methods are designed to use the IsHostAuthority and IsUserAuthority callbacks, respectively, to validate certificates. However, the code did not handle cases where a developer using the library failed to provide these callbacks. Consequently, if an SSH client presented a certificate, the server would attempt to call a nil function pointer, leading to a panic and a denial of service. The patch rectifies this by adding checks at the beginning of both methods to ensure the callbacks are configured, returning an error if they are not, thus preventing the panic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.52.0 | 0.52.0 |
