data/osv/GO-2025-3487.json

{
  "schema_version": "1.3.1",
  "id": "GO-2025-3487",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2025-22869"
  ],
  "summary": "Potential denial of service in golang.org/x/crypto",
  "details": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
  "affected": [
    {
      "package": {
        "name": "golang.org/x/crypto",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35.0"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "golang.org/x/crypto/ssh",
            "symbols": [
              "Client.Dial",
              "Client.DialContext",
              "Client.DialTCP",
              "Client.Listen",
              "Client.ListenTCP",
              "Client.ListenUnix",
              "Client.NewSession",
              "Dial",
              "DiscardRequests",
              "NewClient",
              "NewClientConn",
              "NewServerConn",
              "Request.Reply",
              "Session.Close",
              "Session.CombinedOutput",
              "Session.Output",
              "Session.RequestPty",
              "Session.RequestSubsystem",
              "Session.Run",
              "Session.SendRequest",
              "Session.Setenv",
              "Session.Shell",
              "Session.Signal",
              "Session.Start",
              "Session.WindowChange",
              "channel.Accept",
              "channel.Close",
              "channel.CloseWrite",
              "channel.Read",
              "channel.ReadExtended",
              "channel.Reject",
              "channel.SendRequest",
              "channel.Write",
              "channel.WriteExtended",
              "connection.SendAuthBanner",
              "curve25519sha256.Client",
              "curve25519sha256.Server",
              "dhGEXSHA.Client",
              "dhGEXSHA.Server",
              "dhGroup.Client",
              "dhGroup.Server",
              "ecdh.Client",
              "ecdh.Server",
              "extChannel.Read",
              "extChannel.Write",
              "handshakeTransport.kexLoop",
              "handshakeTransport.recordWriteError",
              "handshakeTransport.writePacket",
              "mux.OpenChannel",
              "mux.SendRequest",
              "newHandshakeTransport",
              "sessionStdin.Close",
              "sshClientKeyboardInteractive.Challenge",
              "tcpListener.Accept",
              "tcpListener.Close",
              "unixListener.Accept",
              "unixListener.Close"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://go.dev/cl/652135"
    },
    {
      "type": "REPORT",
      "url": "https://go.dev/issue/71931"
    }
  ],
  "credits": [
    {
      "name": "Yuichi Watanabe"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2025-3487",
    "review_status": "REVIEWED"
  }
}