golang.org/x/crypto/ssh Denial of service via crafted Signer

HIGH 7.5CVE-2022-27191 · GHSA-8c26-wmh5-6g9v · GO-2021-0356 · Published 18/03/2022 · updated 17/06/2026

In short

CVE-2022-27191 is a HIGH (CVSS 7.5) vulnerability affecting golang.org/x/crypto, extra packages for enterprise linux (fedoraproject), ssh (golang).
Chance of exploitation in the next 30 days (EPSS): 4.0%, higher than 90.4% of all vulnerabilities.
Fix: update to 0.0.0-20220314234659-1baeb1ce4c0b or later.

Package	Affected versions	Patched versions
golang.org/x/crypto Go	`< 0.0.0-20220314234659-1baeb1ce4c0b`	`0.0.0-20220314234659-1baeb1ce4c0b`
extra packages for enterprise linux fedoraproject	`= 8.0`	No fix yet
ssh golang	`< 0.0.0-20220314234659-1baeb1ce4c0b`	`0.0.0-20220314234659-1baeb1ce4c0b`
advanced cluster management for kubernetes redhat	`= 2.0`	No fix yet

Description

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

NVD description

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

References

More vulnerabilities in golang.org/x/crypto

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free