Bug 2415997 (CVE-2025-58181) - CVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
Summary: CVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Se...
Keywords:
Status: NEW
Alias: CVE-2025-58181
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2553143 2553147 2553149 2553154 2553158 2553160 2553162 2553164 2553166 2553170 2553174 2553179 2553188 2553190 2553192 2553196 2553198 2553202 2553204 2553206 2553208 2553212 2553214 2553218 2553220 2553222 2553224 2553226 2553230 2553232 2553296 2553298 2553299 2553300 2553301 2553302 2553303 2553304 2553305 2553306 2553307 2553308 2553309 2553315 2553316 2553317 2553318 2553319 2553320 2553321 2553322 2553323 2553324 2553325 2553326 2553328 2553329 2553330 2553331 2553332 2553333 2553334 2553335 2553336 2553337 2553338 2553339 2553341 2553343 2553344 2553345 2553346 2553348 2553350 2553352 2553355 2553357 2553358 2553359 2553360 2553362 2553363 2553364 2553367 2553369 2424423 2424424 2424425 2424426 2553145 2553151 2553156 2553168 2553172 2553181 2553186 2553194 2553200 2553210 2553216 2553228 2553297 2553310 2553313 2553314 2553340 2553342 2553347 2553351 2553354 2553356 2553361 2553365 2553368
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-19 21:01 UTC by OSIDB Bzimport
Modified: 2026-11-03 08:30 UTC (History)
112 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-11-19 21:01:19 UTC 
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Note You need to log in before you can comment on or make changes to this bug.