What’s Vulnerable › Vulnerabilities

CVE-2020-29652: golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-17 · updated 2026-06-17
• Weakness: CWE-476

Description

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Affected products

• Golang Ssh: through 0.0.0-20201203163018-be400aefbc4c
• Golang.Org/X/Crypto: before 0.0.0-20201216223049-8b5274cf687f — fixed in 0.0.0-20201216223049-8b5274cf687f

How to fix

Upgrade to a fixed version: Golang.Org/X/Crypto 0.0.0-20201216223049-8b5274cf687f. Check the vendor advisory for mitigations.

References

• https://go-review.googlesource.com/c/crypto/+/278852
• https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
• https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E
• https://go-review.googlesource.com/c/crypto/+/278852
• https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
• https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E

Get alerted when CVE-2020-29652 or the next vulnerability affects your stack