CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

[
  {
    "vendor": "golang.org/x/crypto",
    "product": "golang.org/x/crypto/ssh",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "golang.org/x/crypto/ssh",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.52.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "gcmCipher.readCipherPacket"
      },
      {
        "name": "Dial"
      },
      {
        "name": "NewClientConn"
      },
      {
        "name": "NewServerConn"
      },
      {
        "name": "curve25519sha256.Client"
      },
      {
        "name": "curve25519sha256.Server"
      },
      {
        "name": "dhGEXSHA.Client"
      },
      {
        "name": "dhGEXSHA.Server"
      },
      {
        "name": "dhGroup.Client"
      },
      {
        "name": "dhGroup.Server"
      },
      {
        "name": "ecdh.Client"
      },
      {
        "name": "ecdh.Server"
      },
      {
        "name": "mlkem768WithCurve25519sha256.Client"
      },
      {
        "name": "mlkem768WithCurve25519sha256.Server"
      }
    ],
    "defaultStatus": "unaffected"
  }
]