CVE-2026-32952 go-ntlmssp NTLM challenges can panic on malformed payloads
A malicious NTLM challenge message can cause a slice out of bounds panic, crashing Go processes using the go-ntlmssp library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32952?
CVE-2026-32952 is a medium-severity denial of service vulnerability in Azure go-ntlmssp, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.
Weakness: CWE-190
Which versions are affected by CVE-2026-32952?
3 open source packages ship an affected version, including github.com/Azure/go-ntlmssp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Azure/go-ntlmssp Go | All versions | 0.1.1 |
github.com/Azure/go-ntlmssp Go | All versions | 0.1.1 |
github.com/Azure/go-ntlmssp Go | All versions | 0.1.1 |
Linux distribution packages (1)
cmctl openSUSE:Tumbleweed | All versions | 2.5.0-1.1 |
Products include Microsoft Go-Ntlmssp.
How do I fix CVE-2026-32952?
Upgrade github.com/Azure/go-ntlmssp to 0.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32952 being exploited?
There is no known exploitation of CVE-2026-32952 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-ED54467, CLEANSTART-2026-KE06809, CLEANSTART-2026-LM20628, CLEANSTART-2026-RF76675, DEBIAN-CVE-2026-32952, GHSA-pjcq-xvwq-hhpj and 145 more.