Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Ollama‑FIPS, Prometheus‑MySQLd‑Exporter, NFS‑Provisioner can crash via malformed SSH request
published 21 days ago
Summary
The SSH agent component in the listed packages does not verify how large a message is before handling a request for a new identity. A specially crafted, malformed request can cause the program to stop working, potentially interrupting services that rely on it. Apply the vendor’s updates or patches that add proper size checks to prevent the crash.
What to do
- Update cleanstart ollama-fips to version 0.40.3-r1.
- Update cleanstart prometheus-mysqld-exporter to version 0.20.0-r4.
- Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | ollama-fips |
< 0.40.3-r1 Fix: upgrade to 0.40.3-r1
|
| CleanStart | cleanstart | prometheus-mysqld-exporter |
< 0.20.0-r4 Fix: upgrade to 0.20.0-r4
|
| CleanStart | cleanstart | nfs-subdir-external-provisioner |
< 4.0.18-r3 Fix: upgrade to 4.0.18-r3
|
Original advisory text
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read
CVE-2025-47914 affects multiple packages. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-KZ19518 · OSV
Track software like this
Free during beta