Vulnerability Report: GO-2025-3487
- CVE-2025-22869
- Affects: golang.org/x/crypto
- Published: Feb 26, 2025
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
Affected Packages
-
PathGo VersionsSymbols
-
before v0.35.0
25 affected symbols
- Client.Dial
- Client.DialContext
- Client.DialTCP
- Client.Listen
- Client.ListenTCP
- Client.ListenUnix
- Client.NewSession
- Dial
- DiscardRequests
- NewClient
- NewClientConn
- NewServerConn
- Request.Reply
- Session.Close
- Session.CombinedOutput
- Session.Output
- Session.RequestPty
- Session.RequestSubsystem
- Session.Run
- Session.SendRequest
- Session.Setenv
- Session.Shell
- Session.Signal
- Session.Start
- Session.WindowChange
Aliases
References
Credits
- Yuichi Watanabe
Feedback
See anything missing or incorrect?
Suggest an edit to this report.