CVE-2025-47914CWE-125

CVE-2025-47914

Medium · published November 20, 2025

CVSS v3.1

5.3

EPSS

Percentile

45.0

In the wild

Unconfirmed

What it is

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00546 · 45.0th percentile
Weakness: CWE-125 · Out-of-bounds Read
Published: 2025-11-20T02:15Z

Affected products (1)

Product	Versions	Fixed in
golang/crypto	< 0.45.0	0.45.0

References (4)

https://go.dev/cl/721960 · [email protected]https://go.dev/issue/76364 · [email protected]https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA · [email protected]https://pkg.go.dev/vuln/GO-2025-4135 · [email protected]

EPSS history

Timeline

19 NOV 20:33Z
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
cvelistv5