Executive brief
Azure go-ntlmssp is a software library used by Go applications to handle NTLM authentication over HTTP. A vulnerability in this library allows a remote attacker to crash any application using it by sending a specially crafted authentication message. This results in a denial-of-service, potentially disrupting business operations and service availability.
Technical details
A vulnerability exists in the go-ntlmssp library's handling of NTLM challenge messages. The root cause is an integer overflow (CWE-190) during the parsing of malformed payloads, which leads to a slice out-of-bounds panic. A remote, unauthenticated attacker can exploit this by sending a malicious NTLM challenge message to any Go process using `ntlmssp.Negotiator` as an HTTP transport. This results in an immediate crash of the application (Denial of Service). The issue is resolved in version 0.1.1.
Affected products
- Azure go-ntlmssp < 0.1.1
Timeline
- 2026-04-23: patched: Version 0.1.1 released
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-04-24: disclosed: CVE published to NVD