5.3Medium

CVE-2026-39835Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8 Published: 2026-05-22 05:31 (5 months ago)

Description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Weakness (CWE): CWE-476 CWE-295

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
advanced cluster security	4.10	—
advanced cluster security	4.11	—
advanced cluster security	4.9	—
cryostat	4	—
edge manager	1.0	—
edge manager	1.1	—
external secrets operator	1.1	—
golang	crypto	< 0.52.0
golang.org/x/crypto	golang.org/x/crypto/ssh	< 0.52.0
logging	6.6	—
multicluster engine	2.10	—
multicluster engine	2.11	—
multicluster engine	2.17	—
multicluster engine	2.6	—
multicluster engine	2.8	—
openshift	4.22	—
openshift ai	2.25	—
openshift ai	3.4	—
openshift api data protection	1.3	—
openshift api data protection	1.4	—
openshift api data protection	1.5	—
openshift api data protection	1.6	—
openshift builds	1.7	—
openshift builds	1.8	—
openshift data foundation	4.22	—
openshift devspaces	3.30	—
openshift gitops	1.19	—
openshift gitops	1.20	—
quay	3.10	—
quay	3.12	—
quay	3.15	—
quay	3.16	—
quay	3.9	—
Red Hat	Cryostat 4 on RHEL 9	all versions
Red Hat	external secrets operator for Red Hat OpenShift 1.1	all versions
Red Hat	Logging Subsystem for Red Hat OpenShift 6.6	all versions
Red Hat	multicluster engine for Kubernetes 2.1	all versions
Red Hat	multicluster engine for Kubernetes 2.11	all versions
Red Hat	multicluster engine for Kubernetes 2.17	all versions
Red Hat	multicluster engine for Kubernetes 2.6	all versions
Red Hat	multicluster engine for Kubernetes 2.8	all versions
Red Hat	OpenShift API for Data Protection 1.3	all versions
Red Hat	OpenShift API for Data Protection 1.4	all versions
Red Hat	OpenShift API for Data Protection 1.5	all versions
Red Hat	OpenShift API for Data Protection 1.6	all versions
Red Hat	Red Hat Advanced Cluster Security 4.9	all versions
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	all versions
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.11	all versions
Red Hat	Red Hat Edge Manager 1.0	all versions
Red Hat	Red Hat Edge Manager 1.1	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat OpenShift Container Platform 4.22	all versions
Red Hat	RHEM 1.0 for RHEL 9	all versions
Red Hat	RHEM 1.1 for RHEL 10	all versions
Red Hat	RHEM 1.1 for RHEL 9	all versions
trusted artifact signer	1.3	—
trusted artifact signer	1.4	—

References and patches

CPE matches (NVD) (1)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* < 0.52.0

CVSS score

5.3Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

All scores (4)

CISA-ADP	CVSS 3.1	5.3Medium
redhat-SADP	CVSS 3.1	7.5High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.3Medium
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

0.50%

higher than 44% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-04-07
Published2026-05-22 05:31
Reached IP-DB2026-10-24 23:50
Last updated2026-09-18 16:18

Assigned by (CNA): Go
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 yesterday

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 yesterday

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 yesterday

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 yesterday

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 yesterday

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 2 days ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…