Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Priority LOW 25CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing, Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 48 fixed, 20 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295 and CWE-476.
Summary
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00504 43rd percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 68 advisoriesRed Hat: 48 fixed, 20 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/crypto/ssh | before 0.52.0 | 0.52.0 | Patch available | CNA |
| — | golang.org/x/crypto (Go) | before 0.52.0 | 0.52.0 | Patch available | GHSA-78mq-xcr3-xm33 |
- golang.org/x/crypto/ssh VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
- golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-78mq-xcr3-xm33
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | before 0.52.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.52.0
- Fix · GHSA-78mq-xcr3-xm33 golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →
Red Hat 68 advisories
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:76752 Released 2026-10-06 · Red Hat rating ImportantOpenShift Security Profiles Operator bug fix and enhancement update
- OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
Show 65 more Red Hat advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:68541 Released 2026-09-22 · Red Hat rating ImportantOpenShift Container Platform 4.20.39 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9 +10
- RHSA-2026:66358 Released 2026-09-15 · Red Hat rating ImportantOpenShift Container Platform 4.22.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
- RHSA-2026:66352 Released 2026-09-15 · Red Hat rating ImportantOpenShift Container Platform 4.21.33 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:66561 Released 2026-09-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.27-1.27.1-0.1.hum1@aarch64, golang1.27-1.27.1-0.1.hum1@src, golang1.27-1.27.1-0.1.hum1@x86_64 +10
- RHSA-2026:66521 Released 2026-09-10 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.6.1
- Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
- RHSA-2026:66022 Released 2026-09-09 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:62391 Released 2026-09-02 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.26-1.26.8-0.1.hum1@aarch64, golang1.26-1.26.8-0.1.hum1@src, golang1.26-1.26.8-0.1.hum1@x86_64 +10
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.2 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
- RHSA-2026:59467 Released 2026-08-25 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
- RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.5 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
- RHSA-2026:54525 Released 2026-08-13 · Red Hat rating Importantexternal secrets operator for Red Hat OpenShift 1.1.1
- external secrets operator for Red Hat OpenShift 1.1 registry.redhat.io/external-secrets-operator/external-secrets-rhel9
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:51036 Released 2026-08-11 · Red Hat rating ImportantOpenShift Container Platform 4.22.9 packages and security update
- Red Hat OpenShift Container Platform 4.22 openshift-4.22.0-202608010430.p2.g5f1e0e7.assembly.stream.el8, openshift-4.22.0-202608010430.p2.g5f1e0e7.assembly.stream.el9, openshift-hyperkube-4.22.0-202608010430.p2.g5f1e0e7.assembly.stream.el8 +5
- RHSA-2026:51038 Released 2026-08-11 · Red Hat rating ImportantOpenShift Container Platform 4.22.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9 +4
- RHSA-2026:52910 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.20.6 security update
- Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
- RHSA-2026:52857 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.19.6 security update
- Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator
- RHSA-2026:51033 Released 2026-08-06 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
- RHSA-2026:50888 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:49767 Released 2026-08-03 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48771 Released 2026-07-30 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:47949 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.6.13 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +2
- RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.8.9 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
- RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:43692 Released 2026-07-22 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41036 Released 2026-07-16 · Red Hat rating ImportantRed Hat OpenShift Builds 1.8.1
- Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41019 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
- RHSA-2026:40974 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:40972 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:40969 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-monitor-rhel9
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:38504 Released 2026-07-13 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24510+6ea3880e.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24510+6ea3880e.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24510+6ea3880e.s390x::container-tools:rhel8 +47
- RHSA-2026:37410 Released 2026-07-09 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.43.1-3.el9_8, buildah-tests-2:1.43.1-3.el9_8
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:37296 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.0.1 - GA Release Of the Policy Controller Operator
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9-operator
- RHSA-2026:37286 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Tech Preview Release Of the Model Validation Operator
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-validation-rhel9-operator
- RHSA-2026:37276 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:37272 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:37271 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:37268 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9
- RHSA-2026:37123 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.8.2-4.el9_8, podman-docker-6:5.8.2-4.el9_8, podman-plugins-6:5.8.2-4.el9_8 +2
- RHSA-2026:37072 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.8.2-4.el10_2, podman-docker-7:5.8.2-4.el10_2, podman-remote-7:5.8.2-4.el10_2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.8.2-4.el10_2
- RHSA-2026:36796 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
- RHSA-2026:36797 Released 2026-07-08 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:36648 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Builds 1.7.4
- Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
- RHSA-2026:36625 Released 2026-07-08 · Red Hat rating ImportantRHACS 4.10.5 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
- RHSA-2026:36319 Released 2026-07-07 · Red Hat rating ImportantRHACS 4.9.9 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
- RHSA-2026:36199 Released 2026-07-07 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-3.el10_2, buildah-tests-2:1.43.1-3.el10_2
- RHSA-2026:36207 Released 2026-07-07 · Red Hat rating ImportantRHACS 4.11.1 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4
- RHSA-2026:26547 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.10.4 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:26546 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.9.8 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
golang.org/x/crypto/ssh 0.52.0
9 records Highest priority Priority MEDIUM 4 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshPriority MEDIUM 50
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshPriority MEDIUM 48
- TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshPriority MEDIUM 46
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet |
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Workspaces Operator | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Zero Trust Workload Identity Manager | Affected | No fix planned: Will not fix |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix planned: Will not fix |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Logging Subsystem for Red Hat OpenShift 6.6 | Fixed | RHSA-2026:66521 |
| OpenShift API for Data Protection 1.3 | Fixed | RHSA-2026:51033 |
| OpenShift API for Data Protection 1.4 | Fixed | RHSA-2026:59467 |
| OpenShift API for Data Protection 1.5 | Fixed | RHSA-2026:66022 |
| OpenShift API for Data Protection 1.6 | Fixed | RHSA-2026:43692 |
| OpenShift Security Profiles Operator 1 | Fixed | RHSA-2026:76752 |
| RHEM 1.0 for RHEL 9 | Fixed | RHSA-2026:36796 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:41019 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:41019 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:26546, RHSA-2026:36319 |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 | Fixed | RHSA-2026:36207 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:26547, RHSA-2026:36625 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:36199, RHSA-2026:37072 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:38504 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:37123, RHSA-2026:37410 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:37072 |
| Red Hat Hardened Images | Fixed | RHSA-2026:62391, RHSA-2026:66561 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Builds 1.7.3 | Fixed | RHSA-2026:36648 |
| Red Hat OpenShift Builds 1.8.3 | Fixed | RHSA-2026:41036 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:68541 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:66352 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:51036, RHSA-2026:51038, RHSA-2026:66358 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat OpenShift GitOps 1.19 | Fixed | RHSA-2026:52857 |
| Red Hat OpenShift GitOps 1.20 | Fixed | RHSA-2026:52910 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:40969, RHSA-2026:40972, RHSA-2026:40974 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:36797, RHSA-2026:37268, RHSA-2026:37271, RHSA-2026:37272, RHSA-2026:37286, RHSA-2026:37296, RHSA-2026:48771 |
| external secrets operator for Red Hat OpenShift 1.1 | Fixed | RHSA-2026:54525 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:46885 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:57194 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:59593 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:47949 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:47735 |
Not affected: 51 products
- Cryostat 4 on RHEL 9
- ExternalDNS Operator
- Logging Subsystem for Red Hat OpenShift 6.6
- OpenShift API for Data Protection 1.3
- OpenShift API for Data Protection 1.4
- OpenShift API for Data Protection 1.5
- OpenShift API for Data Protection 1.6
- OpenShift Security Profiles Operator 1
- RHEM 1.0 for RHEL 9
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes 4.11
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Builds 1.7.3
- Red Hat OpenShift Builds 1.8.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat OpenShift GitOps
- Red Hat OpenShift GitOps 1.19
- Red Hat OpenShift GitOps 1.20
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-39835
- 2026-10-03 Alias added: GHSA-78mq-xcr3-xm33
- 2026-10-06 EPSS moved to the 50th–90th percentile
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
- 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
- 2026-10-14 EPSS moved to the below the 50th percentile
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
- 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
- 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
- 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
References
Other 59
- https://go.dev/issue/79563
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781660
- https://access.redhat.com/errata/RHSA-2026:26546
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:46885
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:47949
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:51033
- https://access.redhat.com/errata/RHSA-2026:51036
- https://access.redhat.com/errata/RHSA-2026:51038
- https://access.redhat.com/errata/RHSA-2026:52857
- https://access.redhat.com/errata/RHSA-2026:52910
- https://access.redhat.com/errata/RHSA-2026:54525
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:59467
- https://access.redhat.com/errata/RHSA-2026:59593
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66022
- https://access.redhat.com/errata/RHSA-2026:66521
- https://access.redhat.com/security/cve/CVE-2026-39835
- https://bugzilla.redhat.com/show_bug.cgi?id=2480680
- https://cs.opensource.google/go/x/crypto
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json
- https://access.redhat.com/errata/RHSA-2026:26547
- https://access.redhat.com/errata/RHSA-2026:36199
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:37072
- https://access.redhat.com/errata/RHSA-2026:37123
- https://access.redhat.com/errata/RHSA-2026:37268
- https://access.redhat.com/errata/RHSA-2026:37271
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:37286
- https://access.redhat.com/errata/RHSA-2026:37296
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:37410
- https://access.redhat.com/errata/RHSA-2026:38504
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40969
- https://access.redhat.com/errata/RHSA-2026:40972
- https://access.redhat.com/errata/RHSA-2026:40974
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
More Go standard library Crypto vulnerabilities
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
- TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
- TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-39835 · CVE Program
- CVE-2026-39835 · NVD
- FIRST EPSS
- GHSA-78mq-xcr3-xm33 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-39835 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences