CVE-2026-39835
EUVD-2026-3139322.05.2026, 04:16
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| golang | crypto | 𝑥 < 0.52.0 |
𝑥
= Vulnerable software versions
Debian Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| amazon-ssm-agent |
| ||||||||||||||||
| apptainer |
| ||||||||||||||||
| apptainer-sle15_6 |
| ||||||||||||||||
| buildah |
| ||||||||||||||||
| google-guest-agent |
| ||||||||||||||||
| google-osconfig-agent |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| containerd |
| ||||
| containerd-debuginfo |
| ||||
| containerd-debugsource |
| ||||
| containerd-stress |
| ||||
| containerd-stress-debuginfo |
| ||||
| nerdctl |
| ||||
| nerdctl-debuginfo |
| ||||
| rclone |
| ||||
| rclone-debuginfo |
| ||||
| rclone-debugsource |
| ||||
| runfinch-finch |
|
Azure Linux Releases
Azure Package | |||
|---|---|---|---|
| cert-manager |
| ||
| docker-buildx |
| ||
| docker-compose |
| ||
| kubernetes |
| ||
| kubevirt |
| ||
| moby-engine |
| ||
| packer |
| ||
| telegraf |
|
Common Weakness Enumeration
- CWE-295 - Improper Certificate ValidationThe software does not validate, or incorrectly validates, a certificate.
- CWE-476 - NULL Pointer DereferenceA NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
Vulnerability Media Exposure
References