russh
crates.io
SEMVER · introduced 0 → fixed 0.40.2
GHSA-45x7-px36-x8w8Published
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-45x7-px36-x8w8
Publishedgolang.org/x/crypto
Go
SEMVER · introduced 0.1.0 → fixed 0.17.0
paramiko
PyPI
ECOSYSTEM · introduced 2.5.0 → fixed 3.4.0
30 explicitly affected versions
2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.10.5, 2.10.6, 2.11.0, 2.11.1, 2.12.0, 2.5.0, 2.5.1, 2.6.0, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.3.1, 3.3.2
golang.org/x/crypto
Go
SEMVER · introduced 0 → fixed 0.0.0-20231218163308-9d2ee975ef9f
Original source record · Cite this exact observation · Complete original publisher JSON