CVE-2025-22869: Potential denial of service in golang.org/x/crypto
Last updated 9 July 2026
Other sources
Potential denial of service in golang.org/x/crypto
— Microsoft
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/cryptoto a version that resolves this vulnerability.Fixed in 0.35.0 - Upgrade
Upgrade
debian/golang-go.cryptoto a version that resolves this vulnerability.Fixed in 1:0.53.0-1 - Compensating control
Mitigate the SSH file transfer DoS by restricting or rate-limiting client connections/attempts that perform SSH key exchange very slowly or not at all, so pending transferred content is not held in memory indefinitely.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22869?
CVE-2025-22869 is classified as a denial of service vulnerability.
How do I fix CVE-2025-22869?
To mitigate CVE-2025-22869, ensure that your SSH server implementations are updated to the latest versions that address this vulnerability.
What causes CVE-2025-22869?
CVE-2025-22869 is caused by clients completing the key exchange slowly, leading to pending content being read into memory without transmission.
Which software is affected by CVE-2025-22869?
CVE-2025-22869 affects SSH servers that implement file transfer protocols, specifically those using the Go crypto package.
What are the potential impacts of CVE-2025-22869?
The potential impact of CVE-2025-22869 includes denial of service, where excessive memory usage can disrupt service availability.