Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

VectorNETWORK

PublishedNov 19, 2025, 21:15

Published Bysecurity@golang.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

golang.org/x/crypto(Go)00.45.0N/A

References

https://go.dev/cl/721961
https://go.dev/issue/76363
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
https://pkg.go.dev/vuln/GO-2025-4134

Weakness Type

CWE-770

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK