Vulnerability Description
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
References
- https://go.dev/cl/781660
- https://go.dev/issue/79563
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5015
FAQ
What is CVE-2026-39835?
CVE-2026-39835 is a documented vulnerability. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an ...
How severe is CVE-2026-39835?
CVSS scoring is not yet available for CVE-2026-39835. Check NVD for updates.
Is there a patch for CVE-2026-39835?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.