Executive brief
A vulnerability in the Go SSH agent library can cause applications using it to crash when processing specifically malformed data. This could allow a remote attacker to disrupt services or disconnect users by sending "pathological" inputs that trigger a program panic. The issue primarily impacts the availability of services that rely on this library for SSH key management.
Technical details
A vulnerability exists in the golang.org/x/crypto/ssh/agent package where improper validation of array indices (CWE-129) occurs during the parsing of Ed25519 keys. Specifically, the library may attempt to create an 'ed25519.PrivateKey' by casting malformed wire bytes from untrusted network input. When these malformed objects are subsequently used, they trigger a runtime panic, leading to a denial-of-service. The issue affects the ForwardToAgent and ServeAgent functions. A fix is available in version 0.52.0 of the package.
Affected products
- Go Project golang.org/x/crypto/ssh/agent < 0.52.0
Timeline
- 2026-05-22: disclosed: Initial disclosure by the Go Project
- 2026-05-22: advisory: NVD published CVE-2026-46598
- 2026-06-25: patched: GitHub Advisory Database entry published/updated with version 0.52.0 fix