CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Other sources
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/crypto/ssh/agentto a version that resolves this vulnerability.Fixed in 0.52.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.0-23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.14.0-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.27.0-13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.5-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46598?
CVE-2026-46598 has a risk rating of 33, indicating a moderate severity level.
How does CVE-2026-46598 affect the Golang SSH agent?
CVE-2026-46598 can cause client panic in the Golang SSH agent due to the handling of crafted inputs leading to malformed 'ed25519.PrivateKey'.
What are the potential consequences of CVE-2026-46598?
The consequence of CVE-2026-46598 can result in application crashes when the SSH agent is fed pathological inputs.
How can I mitigate CVE-2026-46598?
To mitigate CVE-2026-46598, avoid using untrusted input when creating 'ed25519.PrivateKey' with the Golang SSH agent.
Is CVE-2026-46598 fixed in later versions of Golang?
Check the changelogs and issue tracker for the Golang repository to confirm if CVE-2026-46598 has been addressed in future releases.