CVE-2026-32952: go-ntlmssp NTLM challenges can panic on malformed payloads
go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/Azure/go-ntlmsspto a version that resolves this vulnerability.Fixed in 0.1.1 - Upgrade
Upgrade
go-ntlmssp (ntlmssp.Negotiator)to a version that resolves this vulnerability.Fixed in 0.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32952?
CVE-2026-32952 has a severity rating that indicates a medium risk, primarily due to the potential for denial of service.
How do I fix CVE-2026-32952?
To fix CVE-2026-32952, upgrade the go-ntlmssp package to version 0.1.1 or later.
Which versions of go-ntlmssp are affected by CVE-2026-32952?
Versions of go-ntlmssp prior to 0.1.1 are affected by CVE-2026-32952.
What type of attack does CVE-2026-32952 enable?
CVE-2026-32952 enables a denial of service attack by allowing a malicious NTLM challenge to cause a panic.
Is CVE-2026-32952 specific to any operating systems?
CVE-2026-32952 is specific to Go applications utilizing the go-ntlmssp package regardless of the operating system.