Go x/crypto SSH Vulnerability Fixes: RCE, Bypass, Crash (CVE-2026-46598/46597/39828)

Vulnerability Summary Vulnerability Overview In version v0.52.0 of the library, multiple security vulnerabilities have been fixed, including: 1. ssh/agent: Malicious input may cause client crash - Specially crafted input (such as PrivateKey) can cause client crashes by forging malformed wire bytes. - Reporter: NCC Group Cryptography Services - CVE ID: CVE-2026-46598 - Go issue link: https://go.dev/issue/79596 2. ssh: Byte arithmetic leads to underflow and crash - Incorrect casting from to allows server-side crashes in the AES-GCM packet decoder. - Reporter: Maciej Kącka - CVE ID: CVE-2026-46597 - Go issue link: https://go.dev/issue/79561 3. ssh: Bypassing certificate restrictions - When an SSH server authentication callback returns with non-zero permissions, these permissions are silently discarded, potentially allowing certificate restrictions (such as ) to be bypassed after a second successful attempt. - Reporter: NCC Group Cryptography Services - CVE ID: CVE-2026-39828 - Go issue link: https://go.dev/issue/79562 4. ssh: Client crash during CheckHostKey/Authenticate - SSH servers using as a public key callback without setting or may crash when presents a certificate. Impact Scope Go applications using the library, especially those involving the SSH protocol. In specific scenarios, this may lead to client or server-side crashes, as well as bypassing of certificate restrictions. Remediation Upgrade to version v0.52.0 of the library. For specific fix details, refer to the corresponding Go issue links.

Goal Reached Thanks to every supporter — we hit 100%!

Go x/crypto SSH Vulnerability Fixes: RCE, Bypass, Crash (CVE-2026-46598/46597/39828)