Log in Start free

Vulnerability · Published May 22, 2026 · Assigned by Go

CVE-2026-46597Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

High 7.5

In plain English

A high-severity security flaw in golang.org/x/crypto/ssh from golang.org/x/crypto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-go.cryptono fix listedDEBIAN-CVE-2026-46597
Debian:13golang-go.cryptono fix listedDEBIAN-CVE-2026-46597
Debian:14golang-go.crypto1:0.52.0-1DEBIAN-CVE-2026-46597
Gogolang.org/x/crypto0.52.0GHSA-q4h4-gmj2-qvw2
Gogolang.org/x/crypto0.52.0GO-2026-5013
Ubuntu:25.10golang-go.cryptono fix listedUBUNTU-CVE-2026-46597
Ubuntu:26.10golang-go.cryptono fix listedUBUNTU-CVE-2026-46597
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-46597
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-46597
Ubuntu:25.10google-guest-agentno fix listedUBUNTU-CVE-2026-46597
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-46597
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-46597
Ubuntu:22.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46597
Ubuntu:24.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46597
Ubuntu:25.10snapdno fix listedUBUNTU-CVE-2026-46597
Ubuntu:26.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46597
Ubuntu:26.10snapdno fix listedUBUNTU-CVE-2026-46597

Affected products (as reported)

VendorProductVersions
golang.org/x/crypto golang.org/x/crypto/ssh 0 – before 0.52.0

References