Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Summary
| CVE | CVE-2026-39835 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-22 04:16:24 UTC |
| Updated | 2026-07-10 12:16:45 UTC |
| Description | SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.003940000 probability, percentile 0.315020000 (date 2026-07-12)
Problem Types: CWE-295 | CWE-476 | CWE-476: NULL Pointer Dereference | CWE-476 NULL Pointer Dereference
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| groups.google.com/g/golang-announce/c/a082jnz-LvI | [email protected] | groups.google.com | Mailing List |
| access.redhat.com/errata/RHSA-2026:36797 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37272 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-39835 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36651 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37387 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26546 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/cl/781660 | [email protected] | go.dev | Issue Tracking |
| access.redhat.com/errata/RHSA-2026:37268 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36199 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36207 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26547 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36319 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37410 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37296 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37271 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37123 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36625 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36648 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37072 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36796 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37286 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/issue/79563 | [email protected] | go.dev | Issue Tracking |
| pkg.go.dev/vuln/GO-2026-5015 | [email protected] | pkg.go.dev | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: NCC Group Cryptography Services, sponsored by Teleport (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-05-22T04:01:27.279Z | Reported to Red Hat. |
| ADP | 2026-05-22T02:31:26.982Z | Made public. |
Solutions
ADP: RHSA-2026:36796: RHEM 1.0 for RHEL 9
ADP: RHSA-2026:36199: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:37072: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
ADP: RHSA-2026:37410: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:37123: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11
ADP: RHSA-2026:26546: Red Hat Advanced Cluster Security for Kubernetes 4.9
ADP: RHSA-2026:36319: Red Hat Advanced Cluster Security for Kubernetes 4.9
ADP: RHSA-2026:36651: Red Hat Edge Manager 1.0
ADP: RHSA-2026:36648: Red Hat OpenShift Builds 1.7.4
ADP: RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22
ADP: RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37271: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37268: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37286: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37296: Red Hat Trusted Artifact Signer 1.4
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.