Medium severity · published Nov 19, 2025
CVE-2025-47914
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/crypto/ssh/agent · golang.org/x/crypto
before 0.45.0 · source: vendor
CR
Crypto · Golang
before 0.45.0 · source: NVD
Affected product
GO
golang.org/x/crypto/ssh/agent
golang.org/x/crypto
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47914
Patch
https://go.dev/cl/721960
Issue Tracking
https://go.dev/issue/76364
Mailing List
https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
Vendor Advisory
https://pkg.go.dev/vuln/GO-2025-4135
More from golang.org/x/crypto/ssh/agent
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
9.1
CVE-2026-39833
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
7.5
CVE-2025-47913
Potential denial of service in golang.org/x/crypto/ssh/agent
5.3
CVE-2026-46598
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent