Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2024-45337 · CVE overview and exploitation status

EUVD-2024-3508

GHSA-v778-237x-gjrc

GO-2024-3321

cve-program · CVE-2024-45337

• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
• https://pkg.go.dev/vuln/GO-2024-3321

euvd · EUVD-2024-3508

• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
• https://pkg.go.dev/vuln/GO-2024-3321

nvd · CVE-2024-45337

• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
• https://pkg.go.dev/vuln/GO-2024-3321
• http://www.openwall.com/lists/oss-security/2024/12/11/2
• https://security.netapp.com/advisory/ntap-20250131-0007/

osv · GHSA-v778-237x-gjrc

• https://nvd.nist.gov/vuln/detail/CVE-2024-45337
• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://github.com/golang/crypto
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
• https://pkg.go.dev/vuln/GO-2024-3321
• https://security.netapp.com/advisory/ntap-20250131-0007
• http://www.openwall.com/lists/oss-security/2024/12/11/2

osv · GO-2024-3321

• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ

• Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call … · Advisory content revised · 9 Nov 2026
• Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call … · Advisory content revised · 31 Oct 2026
• Release 2025-03-16 · Tool release · 21 Mar 2025