CVE-2026-46598

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

Medium · published May 22, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00515 · 43.0th percentile
Published
2026-05-22T02:31Z
EPSS history
Timeline
  • 22 MAY 02:31Z
    Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
    cvelistv5