7.5
CVE-2026-39835
- EPSS 0.5%
- Veröffentlicht 22.05.2026 02:31:26
- Zuletzt bearbeitet 20.08.2026 13:18:21
- CVE-Watchlists
- Unerledigt
LoginInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.5% | 0.401 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-295 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CWE-476 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
https://go.dev/issue/79563
https://go.dev/cl/781660
https://bugzilla.redhat.com/show_bug.cgi?id=2480680
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
https://access.redhat.com/errata/RHSA-2026:26546
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:36319
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36625
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36199
https://pkg.go.dev/vuln/GO-2026-5015
https://access.redhat.com/security/cve/CVE-2026-39835
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:37271
https://access.redhat.com/errata/RHSA-2026:37268
https://access.redhat.com/errata/RHSA-2026:37072
https://access.redhat.com/errata/RHSA-2026:37123
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/errata/RHSA-2026:37286
https://access.redhat.com/errata/RHSA-2026:37296
https://access.redhat.com/errata/RHSA-2026:37410
https://access.redhat.com/errata/RHSA-2026:38504
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40974
https://access.redhat.com/errata/RHSA-2026:40969
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:40972
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:43052
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:46885
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:47949
https://access.redhat.com/errata/RHSA-2026:48151
https://access.redhat.com/errata/RHSA-2026:51033
https://access.redhat.com/errata/RHSA-2026:52857
https://access.redhat.com/errata/RHSA-2026:51038
https://access.redhat.com/errata/RHSA-2026:52910
https://access.redhat.com/errata/RHSA-2026:51036
https://access.redhat.com/errata/RHSA-2026:54525
https://access.redhat.com/errata/RHSA-2026:57194