SSH Client Vulnerability in Go Programming Language by Google
CVE-2025-47913

7.5HIGH

Key Information:

Vendor

Golang.org/x/crypto

Status
Golang.org/x/crypto/ssh/agent
Vendor
CVE Published:
13 November 2025

What is CVE-2025-47913?

In the Go programming language, a flaw exists in the SSH client where it can panic and terminate unexpectedly upon receiving an SSH_AGENT_SUCCESS response when a typed input is anticipated. This behavior can lead to a disruption in service for applications relying on the SSH protocol, raising significant concerns for developers and users. It is crucial for users of affected Go versions to implement available patches and updates to mitigate this issue and ensure the stability of their applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

golang.org/x/crypto/ssh/agent 0 < 0.43.0

References

https://go.dev/cl/700295
https://go.dev/issue/75178
https://github.com/advisories/GHSA-56w8-48fp-6mgv

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek
Nicola Murino
JSON
.