golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication

🗓️ 10 Apr 2026 14:24:10Reported by RedHatType

Flaw in golang.org/x/crypto/ssh allows Denial of Service by unbounded memory use from crafted Generic Security Services requests.

Reporter	Title	Published	Views	Family All 836
IBM Security Bulletins	Security Bulletin: Due to use of Golang Go, multiple vulnerabilities affect IBM Cloud Pak System	4 Jul 202600:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in hoek, Bouncy Castle Inc, Spring Framework, golang, Apache Commons, semver and Google Guava might affect IBM Storage Defender Copy Data Management	10 Apr 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	10 Dec 202516:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (May 2026)	14 May 202601:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	25 Jun 202602:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Go affects IBM Robotic Process Automation for Cloud Pak	23 Mar 202613:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto which is vulnerable to CVE-2025-47914, CVE-2025-58181	24 Mar 202607:29	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cloudkit are now addressed in 5.2.3.6 and 6.0.0.1 (CVE-2025-47914, CVE-2025-58181, CVE-2025-47913)	6 Feb 202622:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub	2 Jul 202619:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities affect IBM watsonx Orchestrate with watsonx Assistant Cartridge	23 Mar 202619:50	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	golang1.25	1.25.9-1.hum1	golang1.25-1.25.9-1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	golang1.25	1.25.9-1.hum1	golang1.25-1.25.9-1.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	golang1.25-docs	1.25.9-1.hum1	golang1.25-docs-1.25.9-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-58181
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/721961
go	www.go.dev/issue/76363
groups	www.groups.google.com/g/golang-announce/c/w-oX3UxNcZA
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-58181
pkg	www.pkg.go.dev/vuln/GO-2025-4134
cve	www.cve.org/CVERecord

17 Jul 2026 19:33Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

EPSS0.00533

SSVC

CWE-770