CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/721961	Patch
https://go.dev/issue/76363	Issue Tracking
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA	Mailing List
https://pkg.go.dev/vuln/GO-2025-4134	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Servidores SSH que analizan las solicitudes de autenticación GSSAPI no validan el número de mecanismos especificados en la solicitud, permitiendo a un atacante causar un consumo de memoria ilimitado.

Information

Published : 2025-11-19 21:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-58181

Mitre link : CVE-2025-58181

CVE.ORG link : CVE-2025-58181

JSON object : View

Products Affected

golang

crypto

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-58181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58181", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:49:06.918113Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh", "versions": [{"status": "affected", "version": "0", "lessThan": "0.45.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "parseGSSAPIPayload"}, {"name": "NewServerConn"}]}]}], "published": "2025-11-19T21:15:50.850", "references": [{"url": "https://go.dev/cl/721961", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/76363", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA", "tags": ["Mailing List"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4134", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption."}, {"lang": "es", "value": "Servidores SSH que analizan las solicitudes de autenticaci\u00f3n GSSAPI no validan el n\u00famero de mecanismos especificados en la solicitud, permitiendo a un atacante causar un consumo de memoria ilimitado."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "0DB7D01D-5361-40FC-83A9-91A601A0321D", "versionEndExcluding": "0.45.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}