CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Other sources
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/crypto/sshto a version that resolves this vulnerability.Fixed in 0.52.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46597?
CVE-2026-46597 has a risk level of 40, indicating a moderate severity vulnerability.
How do I fix CVE-2026-46597?
To mitigate CVE-2026-46597, update to the latest version of golang.org/x/crypto/ssh that addresses this vulnerability.
What causes CVE-2026-46597?
CVE-2026-46597 is caused by an incorrectly placed cast from bytes to int in the AES-GCM packet decoder.
What impact does CVE-2026-46597 have on its users?
CVE-2026-46597 can lead to a server-side panic, which affects the stability and security of applications using the library.
Is CVE-2026-46597 exploitable?
Yes, well-crafted inputs can exploit CVE-2026-46597 to trigger an underflow and invoke a panic in the application.