FlawAtlas
Search the atlas
CVE-2026-39835 Moderate

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Exploit probability 0.5%
Published May 22, 2026
Required by Not available
Last source change August 12, 2026

02 / AFFECTED SOFTWARE

Affected packages

Go golang.org/x/crypto
Go golang.org/x/crypto
Unknown Unknown

51 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:21483-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities GHSA-78mq-xcr3-xm33

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

View original source
Open Source Vulnerabilities GO-2026-5015

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

View original source
Open Source Vulnerabilities CVE-2026-39835

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

View original source

05 / REFERENCES

Further evidence