Out-of-bounds Read Affecting golang.org/x/crypto/ssh/agent package, versions <0.45.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GOLANGORGXCRYPTOSSHAGENT-14059804
- published20 Nov 2025
- disclosed19 Nov 2025
- creditJakub Ciolek
Introduced: 19 Nov 2025
NewCVE-2025-47914 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade golang.org/x/crypto/ssh/agent to version 0.45.0 or higher.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Read via the SSH Agent servers. An attacker can cause a panic and disrupt service availability by sending a specially crafted, malformed message that triggers an out-of-bounds read.