CVE-2025-47913: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

CVE-2025-47913 · Severity: high · CVSS 7.5 · Published 2025-11-13

A vulnerability in the Go SSH agent library can cause SSH clients to crash unexpectedly. This occurs when a client receives a specific success message while expecting a different type of data, leading to a service outage for the affected client. This could disrupt automated systems or remote management tools that rely on SSH for secure communication.

Technologies: golang.org/x/crypto (Go), golang.org/x/crypto/ssh/agent (Go). Vendors: Go.

Quick answers

Is CVE-2025-47913 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-47913 being exploited in the wild.
How severe is CVE-2025-47913?
High severity, with a CVSS score of 7.5, published 13 November 2025.
Which products and versions are affected?
crypto/ssh/agent (Go) < 0.43.0; golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.43.0; golang.org/x/crypto/ssh/agent (Go) < 0.43.0, SEMVER:introduced=0,fixed=0.43.0.
Is there a fix for CVE-2025-47913?
Yes. golang.org/x/crypto (Go): upgrade to 0.43.0 or later; golang.org/x/crypto/ssh/agent (Go): upgrade to 0.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-47913 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-47913?
Check whether you run crypto/ssh/agent (Go), golang.org/x/crypto (Go), golang.org/x/crypto/ssh/agent (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • golang.org/x/crypto (Go): upgrade to 0.43.0 or later
    go get golang.org/x/crypto@v0.43.0
  • golang.org/x/crypto/ssh/agent (Go): upgrade to 0.43.0 or later
    go get golang.org/x/crypto/ssh/agent@v0.43.0

Technical details

A Reachable Assertion (CWE-617) exists in the golang.org/x/crypto/ssh/agent package. When an SSH client receives an SSH_AGENT_SUCCESS message while it is expecting a typed response, the library triggers a panic, leading to the immediate termination of the client process. This is a remote denial of service vulnerability that can be triggered without authentication if an attacker can influence the responses from an SSH agent. The issue is fixed in version 0.43.0 of the package.

Affected products

  • Go crypto/ssh/agent < 0.43.0

Identifiers

  • CVE-2025-47913
  • GHSA-56w8-48fp-6mgv
  • GO-2025-4116

Timeline

  • 2025-11-13: disclosed
  • 2025-11-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.