CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

What is CVE-2026-46598?

CVE-2026-46598 is a medium-severity denial of service vulnerability in golang.org/x/crypto/ssh/agent, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Weakness: CWE-129

Which versions are affected by CVE-2026-46598?

3 open source packages ship an affected version, including golang.org/x/crypto. It affects 1 product.

Products include Golang Crypto.

How do I fix CVE-2026-46598?

Upgrade golang.org/x/crypto to 0.52.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-46598 being exploited?

There is no known exploitation of CVE-2026-46598 in the wild and no public exploit code.

Other vulnerabilities in golang.org/x/crypto/ssh/agent

• CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Critical 10.0
• CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Critical 9.1
• CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-87185, AZL-87218, AZL-87329, AZL-87642, AZL-87708, AZL-88203 and 1101 more.