CVE-2025-58181: Unbounded memory consumption in golang.org/x/crypto/ssh
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/cryptoto a version that resolves this vulnerability.Fixed in 0.45.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58181?
The severity of CVE-2025-58181 is classified as high due to the potential for unbounded memory consumption.
How do I fix CVE-2025-58181?
To fix CVE-2025-58181, update to the latest version of the Go crypto/ssh library that addresses this vulnerability.
What vulnerability does CVE-2025-58181 exploit?
CVE-2025-58181 exploits a lack of validation for the number of mechanisms specified in GSSAPI authentication requests.
Who is affected by CVE-2025-58181?
Developers using the Go crypto/ssh library for SSH servers are primarily affected by CVE-2025-58181.
What is the main impact of CVE-2025-58181?
The main impact of CVE-2025-58181 is the potential for denial of service due to unbounded memory consumption.