CVE-2026-32952: go-ntlmssp NTLM challenges can panic on malformed payloads

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-190

Description

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.

Affected products

Azure go-ntlmssp: before 0.1.1 — fixed in 0.1.1
Azure go-ntlmssp: before 0.1.1

How to fix

Upgrade to a fixed version: Azure go-ntlmssp 0.1.1. Check the vendor advisory for mitigations.

References

https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1
https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj

Get alerted when CVE-2026-32952 or the next vulnerability affects your stack