Server-Side Panic in AES-GCM Packet Decoder Affecting Go Programming Language
CVE-2026-46597

7.5HIGH

Key Information:

Vendor: Golang.org/x/crypto
Status: Golang.org/x/crypto/ssh
Vendor: CVE Published:; 22 May 2026

🔔 Create Golang.org/x/crypto Vulnerability Alert

What is CVE-2026-46597?

The vulnerability arises from an improper casting mechanism in the AES-GCM packet decoder utilized by the Go programming language. This flaw can lead to a server-side panic when processing specifically crafted inputs, potentially disrupting service and impacting overall system integrity. Developers using the affected versions of Go must address this issue by ensuring that data types are correctly managed within the packet decoding routines.

Affected Version(s)

golang.org/x/crypto/ssh 0 < 0.52.0

References

https://go.dev/issue/79561

https://groups.google.com/g/golang-announce/c/a082jnz-LvI

https://go.dev/cl/781620

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 22, 2026
Vulnerability Reserved
May 15, 2026

Credit

Maciej Kawka

CVE-2026-46597 Data

JSON