CVE-2025-58181CWE-770denial-of-service

CVE-2025-58181

Medium · published November 20, 2025

CVSS v3.1

5.3

EPSS

Percentile

47.9

In the wild

Unconfirmed

What it is

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00597 · 47.9th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2025-11-20T02:15Z

Affected products (1)

Product	Versions	Fixed in
golang/crypto	< 0.45.0	0.45.0

References (4)

https://go.dev/cl/721961 · [email protected]https://go.dev/issue/76363 · [email protected]https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA · [email protected]https://pkg.go.dev/vuln/GO-2025-4134 · [email protected]

EPSS history

Timeline

19 NOV 20:33Z
Unbounded memory consumption in golang.org/x/crypto/ssh
cvelistv5