CVE-2026-32952

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1	Product Release Notes
https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:go-ntlmssp:*:*:*:*:*:go:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) go-ntlmssp es un paquete de Go que proporciona autenticación NTLM/Negotiate sobre HTTP. Antes de la versión 0.1.1, un mensaje de desafío NTLM malicioso puede causar un pánico de ’slice out of bounds’, lo que puede bloquear cualquier proceso de Go que utilice ’ntlmssp.Negotiator’ como transporte HTTP. La versión 0.1.1 corrige el problema.

Information

Published : 2026-04-24 03:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-32952

Mitre link : CVE-2026-32952

CVE.ORG link : CVE-2026-32952

JSON object : View

Products Affected

microsoft

go-ntlmssp

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-32952", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32952", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T16:29:17.449582Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Azure", "product": "go-ntlmssp", "versions": [{"status": "affected", "version": "< 0.1.1"}]}]}], "published": "2026-04-24T03:16:07.833", "references": [{"url": "https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue."}, {"lang": "es", "value": "go-ntlmssp es un paquete de Go que proporciona autenticaci\u00f3n NTLM/Negotiate sobre HTTP. Antes de la versi\u00f3n 0.1.1, un mensaje de desaf\u00edo NTLM malicioso puede causar un p\u00e1nico de \u2019slice out of bounds\u2019, lo que puede bloquear cualquier proceso de Go que utilice \u2019ntlmssp.Negotiator\u2019 como transporte HTTP. La versi\u00f3n 0.1.1 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:go-ntlmssp:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "DD9C4411-621B-4714-A17D-76CF7D65BF49", "versionEndExcluding": "0.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}