CVE-2026-46595

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Net/url Go

CVE-2026-78662

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto

CVE-2026-56855

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto

CVE-2026-56854

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto

CVE-2026-27140

Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Go Cmd/go

CVE-2026-46603

Excessive memory allocation during VP8L decoding in golang.org/x/image

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image

CVE-2026-56864

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Mod Cmd/go

CVE-2026-56865

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Mod Cmd/go

CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-39833

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed

Vendors

Akka Amazon Apache and 30 more

Products

Http Server Opensearch Data Prepper Apisix and 375 more

CVE-2026-56852

Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Text

CVE-2026-39822

Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Os Go

CVE-2026-42505

Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Crypto Tls Go

CVE-2026-46604

Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image Tiff

CVE-2026-46601

Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image

CVE-2026-46602

Lack of limit on tile sizes in x/image/tiff in golang.org/x/image

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image