CVE-2026-32952

A flaw was found in the go-ntlmssp package (before 0.1.1). A remote attacker can send a crafted NTLM challenge message that triggers a slice out-of-bounds panic, crashing any Go process using ntlmssp.Negotiator as an HTTP transport.

go-ntlmssp is vulnerable to denial of service in NTLM challenge parsing before version 0.1.1. When a Go process uses ntlmssp.Negotiator as an HTTP transport, a remote party can send a malformed NTLM challenge that triggers a slice out-of-bounds panic and crashes the process. Red Hat exposure is narrow: most products that transitively bundle the library (OpenShift must-gather images, CNV must-gather, cert-manager, Ceph dashboard, Ansible Automation Platform utilities) are not affected because they do not use Negotiator against untrusted NTLM endpoints; the remaining risk sits with any Go service that authenticates over HTTP via NTLM/Negotiate and accepts challenge messages from an attacker-influenced source.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.