Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-47913: Go SSH client may crash on unexpected response
CVE-2025-47913 · published 11 months ago
Summary
The SSH client code in Go's go/ssh library can stop working if it receives a success message when it was expecting a typed reply. This can cause the client program to exit unexpectedly, potentially disrupting automated scripts or remote connections. Update to the latest Go crypto libraries to apply the fix.
What to do
- Update x golang.org/x/crypto to version 0.43.0.
- Update golang.org x to version 0.43.0.
- Update x golang.org/x/crypto to version v0.32.0-aikido.5.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.5.
- Update x golang.org/x/crypto to version v0.32.0-aikido.4.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.4.
- Update x golang.org/x/crypto to version v0.32.0-aikido.3.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.3.
- Update x golang.org/x/crypto to version v0.31.0-aikido.9.
- Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.9.
- Update canonical golang-go.crypto to version 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3.
- Update canonical golang-go.crypto to version 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3.
- Update canonical golang-go.crypto to version 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3.
- Update canonical golang-go.crypto to version 1:0.0~git20211202.5770296-1ubuntu0.1~esm3.
- Update canonical golang-go.crypto to version 1:0.19.0-1ubuntu0.1~esm3.
- Update canonical golang-go.crypto to version 1:0.25.0-1ubuntu0.1.
- Update x golang.org/x/crypto to version v0.27.0-aikido.1.
- Update x rootio-golang.org/x/crypto to version v0.27.0-root.io.1.
- Update x golang.org/x/crypto to version v0.21.0-aikido.1.
- Update x rootio-golang.org/x/crypto to version v0.21.0-root.io.1.
- Update debian golang-go.crypto to version 1:0.43.0-1.
- Update x golang.org/x/crypto to version v0.35.0-aikido.6.
- Update x golang.org/x/crypto to version v0.27.0-aikido.2.
- Update x rootio-golang.org/x/crypto to version v0.27.0-root.io.2.
- Update go ssh to version 0.43.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | go | ssh |
< 0.43.0 cpe:2.3:a:go:ssh:*:*:*:*:*:go:*:* |
| Go | x | golang.org/x/crypto |
< 0.43.0 Fix: upgrade to 0.43.0
|
| go | golang.org | x |
< 0.43.0 Fix: upgrade to 0.43.0
|
| Root:Go | x | golang.org/x/crypto |
< v0.32.0-aikido.5 < v0.32.0-aikido.4 < v0.32.0-aikido.3 < v0.31.0-aikido.9 < v0.27.0-aikido.1 < v0.21.0-aikido.1 < v0.35.0-aikido.6 < v0.27.0-aikido.2 Fix: upgrade to v0.32.0-aikido.5
|
| Root:Go | x | rootio-golang.org/x/crypto |
< v0.32.0-root.io.5 < v0.32.0-root.io.4 < v0.32.0-root.io.3 < v0.31.0-root.io.9 < v0.27.0-root.io.1 < v0.21.0-root.io.1 < v0.27.0-root.io.2 Fix: upgrade to v0.32.0-root.io.5
|
| Ubuntu:Pro:16.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3 Fix: upgrade to 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3
|
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3 Fix: upgrade to 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3
|
| Ubuntu:Pro:20.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3 Fix: upgrade to 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3
|
| Ubuntu:22.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20211202.5770296-1ubuntu0.1~esm3 Fix: upgrade to 1:0.0~git20211202.5770296-1ubuntu0.1~esm3
|
| Ubuntu:24.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | golang-go.crypto |
< 1:0.19.0-1ubuntu0.1~esm3 Fix: upgrade to 1:0.19.0-1ubuntu0.1~esm3
|
| Ubuntu:25.10 | canonical | golang-go.crypto |
< 1:0.25.0-1ubuntu0.1 Fix: upgrade to 1:0.25.0-1ubuntu0.1
|
| Ubuntu:25.10 | canonical | snapd | All versions |
| Ubuntu:26.04:LTS | canonical | golang-go.crypto | All versions |
| Ubuntu:26.04:LTS | canonical | snapd | All versions |
| Debian:12 | debian | golang-go.crypto | All versions |
| Debian:14 | debian | golang-go.crypto |
< 1:0.43.0-1 Fix: upgrade to 1:0.43.0-1
|
Original advisory text
CVE-2025-47913 in golang.org/x/crypto - Patched by Root
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
References
- https://ubuntu.com/security/notices/USN-8519-1 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47913
- https://ubuntu.com/security/CVE-2025-47913 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-47913 Third Party Advisory
- https://go-review.googlesource.com/c/crypto/+/700295 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-47913 Vendor Advisory
- https://pkg.go.dev/vuln/GO-2025-4116 Vendor Advisory
- https://github.com/advisories/GHSA-56w8-48fp-6mgv Vendor Advisory
- https://go.dev/issue/75178 Third Party Advisory
- https://go.dev/cl/700295 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-617Reachable Assertion
Timeline
Published13 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-47913 · NVD
GO-2025-4116 · OSV
GHSA-56w8-48fp-6mgv · GHSA
CVE-2025-47913 · OSV
UBUNTU-CVE-2025-47913 · OSV
DEBIAN-CVE-2025-47913 · OSV
Track software like this
Free during beta