CVE-2026-46598

A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial of Service (DoS) for the affected component.

A Moderate denial of service flaw exists in the golang.org/x/crypto/ssh/agent package. This vulnerability allows an attacker to provide specially crafted inputs that, when processed by the SSH agent, can lead to a program panic and crash. This could result in a temporary disruption of services that rely on the affected SSH agent functionality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict the exposure of the SSH agent to untrusted sources. Avoid enabling SSH agent forwarding when connecting to untrusted hosts or environments. Ensure that applications interacting with golang.org/x/crypto/ssh/agent validate all inputs to prevent malformed data from being processed. Reloading or restarting SSH services may be required for changes to take effect.