CVE-2025-58181

MEDIUM

Golang Crypto < 0.45.0 - Resource Allocation Without Limits

Title source: rule

Description

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

References (4)

Scores

CVSS v3 5.3
EPSS 0.0008
EPSS Percentile 24.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Classification

CWE
CWE-770
Status published

Affected Products (2)

golang/crypto < 0.45.0
x/crypto < 0.45.0Go

Timeline

Published Nov 19, 2025
Tracked Since Feb 18, 2026