EUVD-2026-31388CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionNVD
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
AnalysisAI
Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthenticated attackers to crash SSH server processes by sending crafted AES-GCM encrypted packets. An incorrectly placed bytes-to-int cast in the AES-GCM packet decoder triggers a server-side panic when processing well-crafted inputs. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all internal Go applications and third-party services using golang.org/x/crypto/ssh; prioritize SSH servers exposed to untrusted networks. Within 7 days: Upgrade golang.org/x/crypto to version 0.52.0 or later and redeploy affected services. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today