high 7.5

CVE-2026-46597 json

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

published 2026-05-22 5 mo ago modified 2026-09-17 53 d ago also EUVD-2026-31388 , GHSA-q4h4-gmj2-qvw2 , GO-2026-5013

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Patch / fix

fixed in 2 distros 5 links 1

go golang.org/x/crypto 0.52.0
golang.org/x/crypto golang.org/x/crypto/ssh 0.52.0

debian red hat suse opensuse azure linux

golang-go.crypto Debian 14 1:0.52.0-1

debian advisories DEBIAN-CVE-2026-46597

flightctl edge manager 1.1 1.1.4-1.el10em
flightctl edge manager 1.1 1.1.4-1.el9em
flightctl-cli edge manager 1.1 1.1.4-1.el10em
flightctl-cli edge manager 1.1 1.1.4-1.el9em
flightctl-agent edge manager 1.1 1.1.4-1.el10em
flightctl-agent edge manager 1.1 1.1.4-1.el9em
openshift openshift 4.22 4.22.0-202608010430.p2.g5f1e0e7.assembly.stream.el8
openshift openshift 4.22 4.22.0-202608010430.p2.g5f1e0e7.assembly.stream.el9

red hat advisories RHSA-2026:68334 RHSA-2026:67450 RHSA-2026:51036

distribution SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.1-150400.9.41.1
containerized-data-importer SLE Module for Containers 15 SP7 1.64.0-150700.9.14.1
kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.30.1
terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1

suse advisories SUSE-SU-2026:4212-1 SUSE-SU-2026:4209-1 SUSE-SU-2026:3203-1 SUSE-SU-2026:3056-1 SUSE-SU-2026:22613-1 SUSE-SU-2026:2827-1

cloudflared openSUSE Leap 16.0 2026.9.1-bp160.1.1
cloudflared openSUSE Tumbleweed 2026.9.1-1.1
containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
glab openSUSE Leap 16.0 1.114.0-bp160.1.1
kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
rclone openSUSE Leap 16.0 1.74.4-bp160.1.1
cosign openSUSE Leap 16.0 3.1.1-160000.1.1

opensuse advisories openSUSE-SU-2026:21924-1 openSUSE-SU-2026:11813-1 openSUSE-SU-2026:21824-1 openSUSE-SU-2026:21662-1 openSUSE-SU-2026:21590-1 openSUSE-SU-2026:21483-1

cert-manager Azure Linux 3.0 1.12.15-9
cf-cli Azure Linux 3.0 8.7.11-6
docker-buildx Azure Linux 3.0 0.14.0-13
docker-compose Azure Linux 3.0 2.27.0-11
gh Azure Linux 3.0 2.62.0-16
kubernetes Azure Linux 3.0 1.30.10-25
kubevirt Azure Linux 3.0 1.7.1-7
moby-engine Azure Linux 3.0 25.0.3-18

azure linux advisories AZL-87405 AZL-87444 AZL-87630 AZL-87696 AZL-87741 AZL-87900

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.dev/cl/781620 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46597 updated 2026-11-05 cvss 7.5

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, openshift-builds/openshift-builds-image-processing-rhel9
affected: workaround, no fix available
Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/cluster-api-provider-azure-rhel9, multicluster-engine/cluster-image-set-controller-rhel9, multicluster-engine/cluster-api-provider-kubevirt-rhel9 Red Hat OpenShift API for Data Protection openshift4/ose-hypershift-rhel9 Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-results-watcher-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9, openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9, openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator
affected: workaround, no fix available
Red Hat Ceph Storage 9 rhceph/alloy-rhel10
affected: workaround, no fix available “Fix deferred”
Red Hat Enterprise Linux 8 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +4 more Red Hat Enterprise Linux 9 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +5 more Red Hat Enterprise Linux 10 podman, buildah, gvisor-tap-vsock Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9
affected: workaround, no fix available
Red Hat OpenShift Container Platform 4 podman, microshift, podman-tests, podman-docker, podman-remote, microshift-olm, +40 more Red Hat OpenShift Container Platform 5 podman, openshift, microshift, openshift5/ose-dpu-cni-rhel9, openshift5/ose-hyperkube-rhel9, openshift5/ose-dpu-daemon-rhel9, +12 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt Red Hat Quay 3 quay/quay-builder-rhel8, quay/quay-builder-rhel9

+2 more productsfewer

Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/model-validation-agent-rhel9 Red Hat Zero Trust Workload Identity Manager zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9

affected: workaround, no fix available
Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
affected: workaround, no fix planned “Will not fix”

show 13 more

Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
fixed: vendor fix RHSA-2026:82322
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
fixed: vendor fix RHSA-2026:82347
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 cert-manager/jetstack-cert-manager-rhel9 1786613805, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1786613805
fixed: vendor fix RHSA-2026:54531
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/cluster-observability-rhel9-operator 1787593637
fixed: vendor fix RHSA-2026:61314
Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1789659166
fixed: vendor fix RHSA-2026:70870
Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/cluster-logging-rhel9-operator 1788439505
fixed: vendor fix RHSA-2026:66521
Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hypershift-addon-rhel9-operator 1787264068
fixed: vendor fix RHSA-2026:59579
Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hypershift-addon-rhel9-operator 1787259113
fixed: vendor fix RHSA-2026:59558
Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hypershift-addon-rhel9-operator 1786475964
fixed: vendor fix RHSA-2026:59559
Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hypershift-addon-rhel9-operator 1786548381
fixed: vendor fix RHSA-2026:54432
Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/azure-service-operator-rhel9 1790133543, multicluster-engine/hypershift-addon-rhel9-operator 1786912006
fixed: vendor fix RHSA-2026:72848
Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1785180878, oadp/oadp-mustgather-rhel9 1785177359, oadp/oadp-velero-restic-restore-helper-rhel9 1785177438
fixed: vendor fix RHSA-2026:51033
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1786944540, oadp/oadp-mustgather-rhel9 1786946294, oadp/oadp-velero-restic-restore-helper-rhel9 1786946190
fixed: vendor fix RHSA-2026:59467

35 more fixed, 57 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-05-22)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
go	golang.org/x/crypto	<0.52.0	0.52.0

Affected products

golang.org/x/crypto golang.org/x/crypto/ssh

Classification

Weakness

CWE-704 Incorrect Type Conversion or Cast

References

go.dev /cl/781620
web, issue-tracking, patch
pkg.go.dev /vuln/GO-2026-5013
web, vendor-advisory
go.dev /issue/79561
web, issue-tracking, report
groups.google.com /g/golang-announce/c/a082jnz-LvI
web, mailing-list
nvd.nist.gov /vuln/detail/CVE-2026-46597
advisory
cs.opensource.google /go/x/crypto
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary