UNKNOWN Go
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
GO-2026-5013 · CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Published · Modified
Description
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes