golang.org/x/crypto CVE-2026-39835

Upgrade golang.org/x/crypto to version 0.52.0 or later, where CertChecker returns a proper error instead of panicking when authority callbacks are nil; this is the vendor-released patch confirmed by EUVD-2026-31393 and the Go announcement at https://groups.google.com/g/golang-announce/c/a082jnz-LvI. Any binary that vendors golang.org/x/crypto/ssh must be rebuilt and redeployed after the dependency upgrade, as the fix is compiled in. For teams unable to upgrade immediately, an effective compensating control is to explicitly set both IsUserAuthority and IsHostAuthority on every CertChecker instance - even to a function that returns false - before passing it as a callback; this eliminates the nil dereference with no service disruption, though it may silently reject legitimate certificate-based authentication depending on the false-returning stub. Alternatively, replace CertChecker with a fully custom PublicKeyCallback implementation. Avoid relying on recovery middleware as a long-term mitigation, as unhandled panics in other paths may still terminate the process.