Threats affecting pkg:golang/github.com/azure/go-ntlmssp

CVE-2026-32952 is a medium severity vulnerability in the Azure go-ntlmssp Go package prior to version 0.1.1. It involves an integer overflow or wraparound (CWE-190) that can cause a slice out of bounds panic when processing a malicious NTLM challenge message. This panic can crash any Go process using ntlmssp. Negotiator as an HTTP transport. The issue is patched in version 0.1.1. No known exploits are reported in the wild.