{"id":"CVE-2025-47914","sourceIdentifier":"security@golang.org","published":"2025-11-19T21:15:50.517","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read."},{"lang":"es","value":"Los servidores SSH Agent no validan el tamaño de los mensajes al procesar nuevas solicitudes de identidad, lo que puede causar que el programa entre en pánico si el mensaje está malformado debido a una lectura fuera de límites."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh/agent","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"golang.org/x/crypto/ssh/agent","programRoutines":[{"name":"parseConstraints"},{"name":"ForwardToAgent"},{"name":"ServeAgent"}],"versions":[{"version":"0","lessThan":"0.45.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-19T20:50:27.263405Z","id":"CVE-2025-47914","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*","versionEndExcluding":"0.45.0","matchCriteriaId":"0DB7D01D-5361-40FC-83A9-91A601A0321D"}]}]}],"references":[{"url":"https://go.dev/cl/721960","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/76364","source":"security@golang.org","tags":["Issue Tracking","Patch"]},{"url":"https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","source":"security@golang.org","tags":["Mailing List"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4135","source":"security@golang.org","tags":["Vendor Advisory"]}]}