CVE-2025-47913 - Vulnerability Details - OpenCVE

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Golang	Crypto Ssh

No data.

No data.

References

Link	Providers
https://github.com/advisories/GHSA-hcg3-q754-cr77
https://go.dev/cl/700295
https://go.dev/issue/75178
https://pkg.go.dev/vuln/GO-2025-4116

History

Fri, 14 Nov 2025 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang crypto Golang ssh
Vendors & Products		Golang Golang crypto Golang ssh

Thu, 13 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 13 Nov 2025 21:45:00 +0000

Type	Values Removed	Values Added
Description		SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
Title		Potential denial of service in golang.org/x/crypto/ssh/agent
References		https://github.com/advisories/GHSA-hcg3-q754-cr77 https://go.dev/cl/700295 https://go.dev/issue/75178 https://pkg.go.dev/vuln/GO-2025-4116

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-11-13T21:29:39.907Z

Updated: 2025-11-13T21:47:50.864Z

Reserved: 2025-05-13T23:31:29.597Z

Link: CVE-2025-47913

Vulnrichment

Updated: 2025-11-13T21:47:40.788Z

NVD

Status : Awaiting Analysis

Published: 2025-11-13T22:15:51.280

Modified: 2025-11-14T16:42:03.187

Link: CVE-2025-47913

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-47913", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-05-13T23:31:29.597Z", "datePublished": "2025-11-13T21:29:39.907Z", "dateUpdated": "2025-11-13T21:47:50.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-11-13T21:29:39.907Z"}, "title": "Potential denial of service in golang.org/x/crypto/ssh/agent", "descriptions": [{"lang": "en", "value": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process."}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh/agent", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/crypto/ssh/agent", "versions": [{"version": "0", "lessThan": "0.43.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "client.SignWithFlags"}, {"name": "client.List"}, {"name": "agentKeyringSigner.Sign"}, {"name": "agentKeyringSigner.SignWithAlgorithm"}, {"name": "client.Sign"}, {"name": "client.Signers"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-703: Improper Handling of Exceptional Conditions"}]}], "references": [{"url": "https://go.dev/cl/700295"}, {"url": "https://go.dev/issue/75178"}, {"url": "https://github.com/advisories/GHSA-hcg3-q754-cr77"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4116"}], "credits": [{"lang": "en", "value": "Jakub Ciolek"}, {"lang": "en", "value": "Nicola Murino"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T21:47:44.206349Z", "id": "CVE-2025-47913", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T21:47:50.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-47913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T21:47:44.206349Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T21:47:40.788Z"}}], "cna": {"title": "Potential denial of service in golang.org/x/crypto/ssh/agent", "credits": [{"lang": "en", "value": "Jakub Ciolek"}, {"lang": "en", "value": "Nicola Murino"}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh/agent", "versions": [{"status": "affected", "version": "0", "lessThan": "0.43.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh/agent", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "client.SignWithFlags"}, {"name": "client.List"}, {"name": "agentKeyringSigner.Sign"}, {"name": "agentKeyringSigner.SignWithAlgorithm"}, {"name": "client.Sign"}, {"name": "client.Signers"}]}], "references": [{"url": "https://go.dev/cl/700295"}, {"url": "https://go.dev/issue/75178"}, {"url": "https://github.com/advisories/GHSA-hcg3-q754-cr77"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4116"}], "descriptions": [{"lang": "en", "value": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-703: Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-11-13T21:29:39.907Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47913", "state": "PUBLISHED", "dateUpdated": "2025-11-13T21:47:50.864Z", "dateReserved": "2025-05-13T23:31:29.597Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2025-11-13T21:29:39.907Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}