What’s Vulnerable › Products
golang.org/x/crypto/ssh vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your golang.org/x/crypto/ssh version is affected
Latest golang.org/x/crypto/ssh vulnerabilities
- CVE-2026-78662 — Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh (CVSS 7.5)
- CVE-2026-56855 — Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh (CVSS 7.5)
- CVE-2026-56854 — Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh (CVSS 7.5)
- CVE-2026-46598 — Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (CVSS 5.3)
- CVE-2026-46597 — Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (CVSS 7.5)
- CVE-2026-46595 — Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (CVSS 10.0)
- CVE-2026-42508 — Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (CVSS 9.1)
- CVE-2026-39835 — Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (CVSS 5.3)
- CVE-2026-39834 — Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (CVSS 9.1)
- CVE-2026-39833 — Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (CVSS 9.1)
- CVE-2026-39832 — Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (CVSS 9.1)
- CVE-2026-39831 — Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (CVSS 9.1)
- CVE-2026-39830 — Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (CVSS 9.1)
- CVE-2026-39829 — Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (CVSS 7.5)
- CVE-2026-39828 — Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (CVSS 6.3)
- CVE-2026-39827 — Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (CVSS 6.5)
- CVE-2025-58181 — Unbounded memory consumption in golang.org/x/crypto/ssh (CVSS 5.3)
- CVE-2025-47914 — Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (CVSS 5.3)
- CVE-2024-45337 — Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto (CVSS 9.1)
- CVE-2022-30636 — Limited directory traversal vulnerability on Windows in golang.org/x/crypto (CVSS 7.5)
- CVE-2023-48795 — Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (CVSS 5.9)
- CVE-2019-11841 — (CVSS 5.9)
- CVE-2019-11840 — (CVSS 5.9)
- CVE-2017-3204 — (CVSS 8.1)