ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Published Nov 19, 2025 · catalog updated Nov 20, 2025 · SSH servers parsing GSSAPI

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2025-58181. EPSS is 0.60%. Act only if a listed version of SSH servers parsing GSSAPI is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SSH servers parsing GSSAPI).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.60%
Remediation
Fix linked
Affected products
vendor golang.org/x/crypto golang.org/x/crypto/ssh 0 <0.45.0

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor golang.org/x/crypto golang.org/x/crypto/ssh 0 <0.45.00 <0.45.0

How to fix CVE-2025-58181

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-58181. EPSS is 0.60%. Act only if a listed version of SSH servers parsing GSSAPI is installed.

Which versions are affected?

Compare what you have installed with golang.org/x/crypto golang.org/x/crypto/ssh 0 <0.45.0 0 <0.45.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.60%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Related Odoo Git fixes

Quoted Community commit messages that cite this CVE. Presence of a commit is not proof that every edition or backport includes the fix. Enterprise proprietary diffs are never shown here. Timeline

  • Nov 26, 2025 · referenced

    vendor: golang.org/x/crypto v0.45.0

    vendor: golang.org/x/crypto v0.45.0 full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 Hello gophers, We have tagged version v0.45.0 of golang.org/x/crypto in order to address two security issues. This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a vulnerability in the golang.org/x/crypto/ssh/agent package which could cause programs to consume unbounded memory or panic respectively. SSH servers parsing GSSAPI authentication requests don't validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2025-58181 and Go issue https://go.dev/issue/76363. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an…
    https://github.com/moby/moby/commit/bda87b7de87be2bea500b5fe0afde2fb38e99b88

Timeline

Detection, updates, and resolution for this record.

  1. Nov 19, 2025 · EUVD

    Detected

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

  2. Nov 20, 2025 · EUVD

    Updated

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Sources

  • CVE.orgVulnerability recordCVE-2025-58181

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-58181

    30-day exploitation probability 0.60%

    first.org
  • EUVDVulnerability recordEUVD-2025-198228

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Nov 1, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 1, 2026
  • CVE.orgOct 28, 2026
  • EUVDOct 28, 2026