Bug 2416000 (CVE-2025-47914) - CVE-2025-47914 golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
Summary: CVE-2025-47914 golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Se...
Keywords:
Status: NEW
Alias: CVE-2025-47914
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2503168 2503170 2503171 2503173 2503175 2503176 2503177 2503178 2503179 2503180 2503182 2503183 2503186 2503187 2503188 2503189 2503190 2503191 2503193 2503194 2503195 2503196 2503197 2503199 2503201 2503202 2503203 2503204 2503205 2503206 2503207 2503208 2503209 2503212 2503213 2503214 2503215 2503217 2503218 2503219 2503220 2503221 2503222 2503223 2503224 2503225 2503226 2503227 2503228 2503229 2503230 2503231 2503232 2503233 2503234 2503235 2503236 2503237 2503238 2503239 2503240 2503241 2503242 2503243 2503244 2503245 2503246 2503247 2503248 2503249 2503251 2503252 2503253 2503254 2503255 2503256 2503257 2503258 2503259 2503260 2503264 2503265 2503266 2503267 2503268 2503272 2503273 2503276 2503277 2503278 2503279 2503281 2503282 2503283 2503284 2503285 2503286 2503287 2503288 2503289 2503290 2503291 2503292 2503293 2503294 2503295 2503296 2503297 2503298 2503299 2503300 2503301 2503302 2503303 2503304 2503305 2503306 2503307 2503308 2503309 2503310 2503311 2503312 2503314 2503315 2503316 2503317 2503318 2503319 2503320 2503321 2503322 2503323 2503325 2503327 2503328 2503329 2503330 2503331 2503332 2503333 2503334 2503336 2503337 2503339 2503340 2503342 2503344 2503345 2503346 2503347 2503348 2503349 2503351 2503352 2503355 2503356 2503357 2503358 2503360 2503361 2503363 2503364 2503365 2503366 2503367 2503369 2503371 2503372 2503373 2503374 2503375 2503376 2503377 2503378 2503379 2503382 2503383 2503384 2503385 2503387 2503388 2503389 2503390 2503391 2503392 2503393 2503396 2503398 2503399 2503401 2503403 2503404 2503405 2503406 2503407 2503408 2503412 2503414 2503421 2503424 2503427 2503429 2503431 2503433 2503438 2503441 2503443 2503445 2503448 2503453 2503457 2503459 2503462 2503464 2503466 2503469 2503471 2503474 2503476 2503484 2503486 2503490 2503493 2503499 2503503 2503506 2503509 2503511 2503514 2503516 2503518 2503520 2503523 2503526 2503528 2503529 2503530 2503531 2503532 2503533 2503534 2503535 2503536 2503537 2503538 2503539 2503540 2503541 2503542 2503543 2503544 2503545 2503546 2503547 2503548 2503549 2503551 2503552 2503553 2503554 2503555 2503556 2503557 2503558 2503559 2503560 2503564 2503565 2503566 2503567 2503568 2503570 2503571 2503574 2503575 2503576 2503577 2503579 2503580 2503581 2503582 2503583 2503584 2503585 2503586 2503587 2503588 2503589 2503590 2503591 2503592 2503593 2503594 2503595 2503596 2503597 2503598 2503599 2503600 2503601 2503602 2503603 2503604 2503605 2503606 2503607 2503608 2503609 2503610 2503611 2503612 2503613 2503614 2503615 2503616 2503617 2503618 2503619 2503620 2503621 2503623 2503625 2503626 2503627 2503628 2503629 2503630 2503631 2503632 2503634 2424428 2424429 2424430 2424431 2424446 2424447 2424448 2424449 2503169 2503172 2503174 2503181 2503184 2503185 2503192 2503198 2503200 2503210 2503211 2503216 2503250 2503261 2503262 2503263 2503270 2503274 2503275 2503280 2503313 2503324 2503326 2503335 2503338 2503341 2503343 2503350 2503353 2503354 2503362 2503368 2503370 2503380 2503381 2503386 2503397 2503400 2503402 2503410 2503417 2503419 2503436 2503450 2503455 2503479 2503481 2503495 2503550 2503561 2503562 2503563 2503569 2503572 2503573 2503578 2503622 2503624 2503633
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-19 21:01 UTC by OSIDB Bzimport
Modified: 2026-07-21 13:16 UTC (History)
106 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-11-19 21:01:33 UTC 
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Note You need to log in before you can comment on or make changes to this bug.