CVE-2026-39835: Golang Crypto

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Affected products

• Golang Crypto: before 0.52.0 (fixed in 0.52.0)

Published 2026-05-22. Last modified 2026-09-18.