Golang.org/x/crypto Golang.org/x/crypto/ssh vulnerabilities

2 CVEs affecting Golang.org/x/crypto Golang.org/x/crypto/ssh, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56854, published 2026-08-28.

More from Golang.org/x/crypto.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-45337, published 2024-12-12. Critical severity, CVSS 9.1. EPSS: 3.2% chance of exploitation in the next 30 days. Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for…
• CVE-2026-56854, published 2026-08-28. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for…