SSH Agent Vulnerability in Go Programming Language
CVE-2025-47914

5.3MEDIUM

Key Information:

Vendor: Golang.org/x/crypto
Status: Golang.org/x/crypto/ssh/agent
Vendor: CVE Published:; 19 November 2025

🔔 Create Golang.org/x/crypto Vulnerability Alert

What is CVE-2025-47914?

In the Go programming language, SSH Agent servers fail to properly validate the size of messages when processing new identity requests. This flaw may lead to a program panic, particularly when malformed messages result in an out of bounds read condition. This vulnerability highlights the necessity for robust message validation to prevent potential disruptions in SSH Agent functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

golang.org/x/crypto/ssh/agent 0 < 0.45.0

References

https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA

https://go.dev/cl/721960

https://go.dev/issue/76364

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Nov 19, 2025
Vulnerability Reserved
May 13, 2025

Credit

Jakub Ciolek

JSON

Golang.org/x/crypto

What is CVE-2025-47914?

Human OS v1.0: Ageing Is an Unpatched Zero-Day Vulnerability.

Affected Version(s)

References

CVSS V3.1

Timeline

Credit

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.