Vulnerability Description
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
CVSS Score
5.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Crypto | < 0.45.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/721960Patch
- https://go.dev/issue/76364Issue TrackingPatch
- https://groups.google.com/g/golang-announce/c/w-oX3UxNcZAMailing List
- https://pkg.go.dev/vuln/GO-2025-4135Vendor Advisory
FAQ
What is CVE-2025-47914?
CVE-2025-47914 is a vulnerability with a CVSS score of 5.3 (MEDIUM). SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
How severe is CVE-2025-47914?
CVE-2025-47914 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-47914?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Crypto.