ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32952

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP.

Published Apr 24, 2026 · updated Jun 17, 2026 · microsoft go-ntlmssp

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using as an HTTP transport. Version 0.1.1 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2026 · NIST NVD

    Detected

    go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using as an HTTP transport. Version 0.1.1 patches the issue.

  2. Jun 17, 2026 · NIST NVD

    Updated

    go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using as an HTTP transport. Version 0.1.1 patches the issue.

Affected

  • cpe microsoft/go-ntlmsspversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32952

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32952

    go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using as an HTTP transport. Version 0.1.1 patc

    nvd.nist.gov

References