Is golang.org/x/crypto/ssh/agent affected by CVE-2026-46598?

Go golang.org/x/crypto/ssh/agent is affected in < 0.52.0.

Is CVE-2026-46598 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

medium

CVE-2026-46598

Q: Is CVE-2026-46598 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

Go · golang.org/x/crypto/ssh/agent • Go · golang.org/x/crypto

Summary

golang.org/x/crypto/ssh/agent: Invoking pathological inputs can lead to client panic

Severity: medium
CVSS: 5.3
EPSS: 0.4% (p35)
CWE: CWE-129
Also known as: GHSA-9m57-25v3-79x9, GO-2026-5033
Published: 2026-06-25
Updated: 2026-06-25

Advisory details

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

References

Related advisories

CVE-2026-39832 — critical · Go/golang.org/x/crypto/ssh/agent
CVE-2026-39833 — critical · Go/golang.org/x/crypto/ssh/agent
CVE-2026-55209 — critical · PyPI/resdata
CVE-2026-84445 — high · Go/google.golang.org/grpc
CVE-2026-52856 — high · Go/github.com/pterodactyl/wings
GHSA-26gq-p25f-99cp — high · Go/github.com/fatedier/frp
GHSA-cqjc-rmpq-xprq — medium · crates.io/russh
CVE-2026-49838 — medium · Go/github.com/osrg/gobgp/v4

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.