CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Published May 22, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-78mq-xcr3-xm33 golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:26546 cve-icon
https://access.redhat.com/errata/RHSA-2026:26547 cve-icon
https://access.redhat.com/errata/RHSA-2026:36199 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36625 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:37072 cve-icon
https://access.redhat.com/errata/RHSA-2026:37123 cve-icon
https://access.redhat.com/errata/RHSA-2026:37268 cve-icon
https://access.redhat.com/errata/RHSA-2026:37271 cve-icon
https://access.redhat.com/errata/RHSA-2026:37272 cve-icon
https://access.redhat.com/errata/RHSA-2026:37286 cve-icon
https://access.redhat.com/errata/RHSA-2026:37296 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:37410 cve-icon
https://access.redhat.com/errata/RHSA-2026:38504 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40262 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40969 cve-icon
https://access.redhat.com/errata/RHSA-2026:40972 cve-icon
https://access.redhat.com/errata/RHSA-2026:40974 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41031 cve-icon
https://access.redhat.com/errata/RHSA-2026:41036 cve-icon
https://access.redhat.com/errata/RHSA-2026:41066 cve-icon
https://access.redhat.com/errata/RHSA-2026:42146 cve-icon
https://access.redhat.com/errata/RHSA-2026:42796 cve-icon
https://access.redhat.com/errata/RHSA-2026:43052 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:46885 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:47949 cve-icon
https://access.redhat.com/errata/RHSA-2026:48151 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51036 cve-icon
https://access.redhat.com/errata/RHSA-2026:51038 cve-icon
https://access.redhat.com/errata/RHSA-2026:52857 cve-icon
https://access.redhat.com/errata/RHSA-2026:52910 cve-icon
https://access.redhat.com/errata/RHSA-2026:54525 cve-icon
https://access.redhat.com/errata/RHSA-2026:57194 cve-icon
https://access.redhat.com/errata/RHSA-2026:59467 cve-icon
https://access.redhat.com/errata/RHSA-2026:59593 cve-icon
https://access.redhat.com/errata/RHSA-2026:60520 cve-icon
https://access.redhat.com/errata/RHSA-2026:62260 cve-icon
https://access.redhat.com/errata/RHSA-2026:65126 cve-icon
https://access.redhat.com/errata/RHSA-2026:66022 cve-icon
https://access.redhat.com/errata/RHSA-2026:66521 cve-icon
https://access.redhat.com/security/cve/CVE-2026-39835 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2480680 cve-icon
https://go.dev/cl/781660 cve-icon cve-icon
https://go.dev/issue/79563 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/a082jnz-LvI cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-5015 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json cve-icon
History
Type Values Removed Values Added
Weaknesses CWE-476
Type Values Removed Values Added
First Time appeared Golang crypto
Weaknesses CWE-295
CPEs cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
Vendors & Products Golang crypto
Type Values Removed Values Added
Weaknesses CWE-476
Type Values Removed Values Added
Weaknesses CWE-476
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Golang
Golang ssh
Vendors & Products Golang
Golang ssh
Type Values Removed Values Added
Weaknesses CWE-476
Type Values Removed Values Added
Description SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
Title Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 18, 2026, 12:04 PM
Reserved
Apr 7, 2026, 6:13 PM
Status
Modified
Published
May 22, 2026, 4:16 AM
Modified
Sep 18, 2026, 1:18 PM