CVE-2026-39835

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Score
CVSS 3.1 7.5 High
Status
Modified - security@golang.org
Published
2026-05-22
Last modified
2026-09-18
Weaknesses
CWE-295, CWE-476

Affected products

References

 
 
© AVABIS GmbH privacypolicy about