EUVD-2026-31393
Improper Certificate Validation (CWE-295)
2026-05-22
Go
5.3
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Lifecycle Timeline
4
Analysis Generated
May 28, 2026 - 15:08 vuln.today
CVSS changed
May 28, 2026 - 15:07 NVD
5.3 (None)
5.3 (MEDIUM)
Patch available
May 22, 2026 - 04:31 EUVD
CVE Published
May 22, 2026 - 02:31 nvd
UNKNOWN (no severity yet)
DescriptionNVD
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
AnalysisAI
Unauthenticated remote clients can crash SSH servers built with golang.org/x/crypto/ssh by presenting a certificate during the handshake when CertChecker is used as a public key callback without initializing IsUserAuthority or IsHostAuthority. All versions prior to 0.52.0 are affected; the nil function pointer dereference causes a Go runtime panic that terminates the SSH service. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).