EUVD-2026-25374
GHSA-pjcq-xvwq-hhpj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
A Go runtime panic caused by crafted input crashes the entire process (A:H); all other metrics align with the provided vector since no privilege or interaction is required on the attacker side.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.
AnalysisAI
Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a malicious HTTP server to crash any Go process that uses ntlmssp.Negotiator as its HTTP transport by returning a crafted NTLM challenge message. The malformed payload triggers a slice out-of-bounds panic - a fatal runtime condition in Go - causing complete process termination. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.06% (18th percentile) reflects very low opportunistic exploitation probability at time of analysis.
Technical ContextAI
go-ntlmssp is a Go library implementing NTLM/Negotiate authentication layered over standard HTTP transports, identified by CPE pkg:go/github.com_azure_go-ntlmssp. It is used by Go applications that need to authenticate to Windows-integrated HTTP endpoints such as SharePoint, IIS, or corporate proxies. The root cause is classified as CWE-190 (Integer Overflow or Wraparound), which produces an invalid slice index during parsing of the NTLM Type-2 challenge message. In Go, accessing a slice with an out-of-bounds index is an unrecoverable runtime panic - unless explicitly caught via recover() - that terminates the affected goroutine and typically the entire process. The vulnerability is client-side: it manifests during the handshake phase when the client processes the server-issued challenge, meaning the attacker must control or influence the HTTP server the victim application connects to.
RemediationAI
Vendor-released patch: v0.1.1. Upgrade go-ntlmssp to version 0.1.1 or later by running go get github.com/Azure/go-ntlmssp@v0.1.1 and committing the updated go.mod and go.sum files. The patched release notes and binaries are available at https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1. If immediate upgrade is blocked by dependency constraints, a targeted compensating control is to restrict the application's outbound HTTP destinations to a known-good allowlist of trusted internal endpoints, preventing any attacker-controlled server from delivering a crafted challenge - though this may break legitimate NTLM authentication to newly added endpoints and requires firewall or application-layer egress filtering.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today