CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

What is CVE-2026-39835?

CVE-2026-39835 is a medium-severity vulnerability in golang.org/x/crypto/ssh, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Weakness: CWE-476, CWE-295

Which versions are affected by CVE-2026-39835?

3 open source packages ship an affected version, including golang.org/x/crypto. It affects 1 product.

Products include Golang Crypto.

How do I fix CVE-2026-39835?

Upgrade golang.org/x/crypto to 0.52.0 or later.

Is CVE-2026-39835 being exploited?

There is no known exploitation of CVE-2026-39835 in the wild and no public exploit code.

Other vulnerabilities in golang.org/x/crypto/ssh

• CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Critical 10.0
• CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Critical 9.1
• CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-87191, AZL-87248, AZL-87308, AZL-87417, AZL-87465, AZL-87627 and 1112 more.