Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

Vulnerability

Description

CVE-2025-47914 is a denial-of-service vulnerability in the SSH Agent server implementation within the golang.org/x/crypto/ssh/agent package. The server does not validate the size of messages when processing new identity requests, leading to an out-of-bounds read condition when a malformed message is received [1][4].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted, undersized identity request message to a vulnerable SSH Agent server. No authentication is required; the attacker only needs network access to the agent port [1][4]. The flaw can be triggered during the parsing of the message, before any identity processing occurs.

Impact

Successful exploitation causes the program to panic, resulting in a denial of service (DoS). The agent becomes unavailable for legitimate authentication operations until restarted [1][4].

Mitigation

The vulnerability is fixed in golang.org/x/crypto version v0.45.0. Users are advised to update to this or a later version to prevent the issue [2][4].