Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-46597 · CVE overview and exploitation status

EUVD-2026-31388

GHSA-q4h4-gmj2-qvw2

GO-2026-5013

cve-program · CVE-2026-46597

• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781620
• https://pkg.go.dev/vuln/GO-2026-5013

euvd · EUVD-2026-31388

• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781620
• https://pkg.go.dev/vuln/GO-2026-5013

nvd · CVE-2026-46597

• https://go.dev/cl/781620
• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5013

osv · GHSA-q4h4-gmj2-qvw2

• https://nvd.nist.gov/vuln/detail/CVE-2026-46597
• https://cs.opensource.google/go/x/crypto
• https://go.dev/cl/781620
• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5013

osv · GO-2026-5013

• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781620

• An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. · Advisory content revised · 15 Nov 2026
• An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. · Advisory content revised · 13 Nov 2026
• An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. · Advisory content revised · 7 Nov 2026
• An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. · Advisory content revised · 1 Nov 2026