CR
Product
Crypto
21
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 7High 5Medium 9Low 0
Watch
Add Crypto to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46595 | 10.0 | May 22 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-42508 | 9.1 | May 22 | Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts Affected: before 0.52.0 |
| CVE-2026-39834 | 9.1 | May 22 | Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-39831 | 9.1 | May 22 | Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-39830 | 9.1 | May 22 | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-39832 | 9.1 | May 22 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Affected: before 0.52.0 |
| CVE-2026-39833 | 9.1 | May 22 | Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Affected: before 0.52.0 |
| CVE-2017-3204 | 8.1 | Apr 4 | The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks Affected: through 2017-03-17 |
| CVE-2026-56855 | 7.5 | Sep 2 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh Affected: before 0.56.0 |
| CVE-2026-78662 | 7.5 | Sep 2 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh Affected: before 0.56.0 |
| CVE-2026-39829 | 7.5 | May 22 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-46597 | 7.5 | May 22 | Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-39827 | 6.5 | May 22 | Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2026-39828 | 6.3 | May 22 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: before 0.17.0 |
| CVE-2019-11841 | 5.9 | May 22 | A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25 Affected: 2019-03-25 |
| CVE-2019-11840 | 5.9 | May 9 | An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576 Affected: All versions, or not specified |
| CVE-2026-46598 | 5.3 | May 22 | Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent Affected: before 0.52.0 |
| CVE-2026-39835 | 5.3 | May 22 | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh Affected: before 0.52.0 |
| CVE-2025-58181 | 5.3 | Nov 19 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption Affected: before 0.45.0 |
| CVE-2025-47914 | 5.3 | Nov 19 | SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of… Affected: before 0.45.0 |
Showing 21