{"id":"GO-2025-4134","revision":"82f6461be425455d94c6d2161e699700","records":[{"revision":"82f6461be425455d94c6d2161e699700","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4134","aliases":["CVE-2025-58181","GHSA-j5w8-q4qc-rx2x"],"title":"Unbounded memory consumption in golang.org/x/crypto/ssh","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","state":0,"publishedAt":"2025-11-19T20:11:57+00:00","modifiedAt":"2026-05-15T10:59:24.7849137+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.45.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","https://go.dev/cl/721961","https://go.dev/issue/76363"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4134","license":"OSV · upstream source license applies","key":"osv:GO-2025-4134","identifiers":["GO-2025-4134","CVE-2025-58181","GHSA-j5w8-q4qc-rx2x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}