Threat Intelligence Database

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-46598 is a medium severity vulnerability in the golang.org/x/crypto/ssh/agent package caused by improper validation of an array index. Malformed input can trigger a panic when creating an ed25519 PrivateKey, leading to a denial-of-service condition. There is no impact on confidentiality or integrity. No official patch or remediation guidance is currently available.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

CVE-2025-47914 is a medium severity vulnerability in the golang.org/x/crypto/ssh/agent package where SSH Agent servers do not validate message sizes when processing new identity requests. This can cause the program to panic due to an out of bounds read if a malformed message is received.

CVE-2025-47913 is a high-severity vulnerability in the golang.org/x/crypto SSH agent package where SSH clients panic and terminate unexpectedly upon receiving an SSH_AGENT_SUCCESS message when a typed response is expected. This improper handling of exceptional conditions (CWE-703) leads to denial of service by crashing the client process without requiring authentication or user interaction. The vulnerability affects all versions of the golang.org/x/crypto/ssh/agent package and has a CVSS score of 7.5, indicating significant impact on availability. No known exploits are currently reported in the wild. European organizations using Go-based SSH clients that rely on this package may face service disruptions, particularly in critical infrastructure and development environments. Mitigation involves updating to patched versions once available and implementing robust error handling around SSH agent responses. Countries with strong software development sectors and critical infrastructure relying on Go are most at risk, including Germany, France, the UK, and the Netherlands.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-47913#cwe-703