SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/721961 | Patch |
| https://go.dev/issue/76363 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA | Mailing List |
| https://pkg.go.dev/vuln/GO-2025-4134 | Vendor Advisory |
Configurations
History
11 Dec 2025, 19:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Golang crypto
Golang |
|
| References | () https://go.dev/cl/721961 - Patch | |
| References | () https://go.dev/issue/76363 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2025-4134 - Vendor Advisory | |
| CPE | cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* |
19 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-19 21:15
Updated : 2025-12-11 19:29
NVD link : CVE-2025-58181
Mitre link : CVE-2025-58181
CVE.ORG link : CVE-2025-58181
JSON object : View
Products Affected
golang
- crypto
CWE
CWE-770
Allocation of Resources Without Limits or Throttling