What’s Vulnerable › Vulnerabilities

CVE-2021-43565: x/crypto/ssh vulnerable to panic via malformed packets

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-06 · updated 2026-06-17

Description

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

Affected products

• Golang Ssh: before 0.0.0-20211202192323-5770296d904e — fixed in 0.0.0-20211202192323-5770296d904e
• Golang.Org/X/Crypto: before 0.0.0-20211202192323-5770296d904e — fixed in 0.0.0-20211202192323-5770296d904e

How to fix

Upgrade to a fixed version: Golang Ssh 0.0.0-20211202192323-5770296d904e; Golang.Org/X/Crypto 0.0.0-20211202192323-5770296d904e. Check the vendor advisory for mitigations.

References

• https://groups.google.com/forum/#%21forum/golang-announce
• https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs
• https://groups.google.com/forum/#%21forum/golang-announce
• https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs

Get alerted when CVE-2021-43565 or the next vulnerability affects your stack