CVE-2025-22869: Potential denial of service in golang.org/x/crypto

Analyzed

AliasesRHSA-2025:3165RHSA-2025:3175RHSA-2025:3184+2948 more

Published 26-02-2025Last modified 11-04-2025

Vulnerability summary

CVE-2025-22869 is a high (CVSS 7.5) vulnerability in go ssh. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.94%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 90 · Related 836

MGASA-2026-0147 OPENSUSE-SU-2025:0094-1 OPENSUSE-SU-2025:14839-1 OPENSUSE-SU-2025:14843-1 OPENSUSE-SU-2025:14909-1 OPENSUSE-SU-2025:14918-1+94 more

Showing 100 of 837.

Timeline

26-02-2025
PublishedVulnerability first disclosed.
11-04-2025
Last modifiedVulnerability information updated.

Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

CVSS metrics

9 scores · 9 sources · 1 version

v3.17.5

EPSS trend

Probability

0.94%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.94% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r27
actions-runner-controller< 0.10.1-r4
actions-runner-controller-compat< 0.10.1-r4
actions-runner-controller-fips< 0.10.1-r4
actions-runner-controller-fips-compat< 0.10.1-r4

age< 1.2.1-r3
age-fips< 1.2.1-r3
agentbeat-fips< 8.17.3-r1
amass< 4.2.0-r20
amazon-cloudwatch-agent< 1.300054.0-r1
amazon-cloudwatch-agent-all< 1.300054.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300054.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300053.0-r7
amazon-cloudwatch-agent-compat< 1.300054.0-r1
amazon-cloudwatch-agent-config-downloader< 1.300054.0-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300053.0-r7
amazon-cloudwatch-agent-config-translator< 1.300054.0-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300053.0-r7
amazon-cloudwatch-agent-fips< 1.300053.0-r7
amazon-cloudwatch-agent-operator< 2.2.0-r1
amazon-cloudwatch-agent-operator-compat< 2.2.0-r1
amazon-cloudwatch-agent-operator-fips< 2.2.0-r1
amazon-cloudwatch-agent-operator-fips-compat< 2.2.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300054.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300053.0-r7
amazon-ssm-agent< 3.3.1957.0-r5
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r5
apko< 0.25.5-r0
argo-cd-2.11< 2.11.13-r4
argo-cd-2.13< 2.13.5-r6
argo-cd-2.13-compat< 2.13.5-r6
argo-cd-2.13-repo-server< 2.13.5-r6
argo-cd-2.14< 2.14.7-r0
argo-cd-2.14-compat< 2.14.7-r0
argo-cd-2.14-repo-server< 2.14.7-r0
argo-cd-fips-2.14< 2.14.5-r1
argo-cd-fips-2.14-compat< 2.14.5-r1
argo-cd-fips-2.14-repo-server< 2.14.5-r1
argo-events< 1.9.5-r3
argo-events-fips< 1.9.5-r4
argo-rollouts< 1.8.0-r31
argo-rollouts-fips< 1.8.0-r4
argo-workflows< 3.6.5-r0
argo-workflows-fips< 3.6.5-r2
argocd-image-updater< 0.15.2-r8
argocd-image-updater-compat< 0.15.2-r8
argocd-image-updater-fips< 0.15.2-r7
atlantis< 0.33.0-r2
atlantis-fips< 0.33.0-r3
auditbeat-7< 7.17.28-r5
auditbeat-7-oci-entrypoint< 7.17.28-r5
auditbeat-fips-7< 7.17.28-r2
authservice< 1.0.4-r2
authservice-compat< 1.0.4-r2
authservice-fips< 1.0.4-r2
authservice-fips-compat< 1.0.4-r2
azcopy< 10.28.0-r4
azcopy-fips< 10.28.0-r2
azure-aad-pod-identity-mic< 1.8.17-r19
azure-aad-pod-identity-nmi< 1.8.17-r19
azuredisk-csi-1.28< 1.28.11-r8
azuredisk-csi-1.28-compat< 1.28.11-r8
azuredisk-csi-1.29< 1.29.12-r3
azuredisk-csi-1.29-compat< 1.29.12-r3
azuredisk-csi-1.30< 1.30.9-r2
azuredisk-csi-1.30-compat< 1.30.9-r2
azuredisk-csi-1.31< 1.31.5-r0
azuredisk-csi-1.31-compat< 1.31.5-r0
azuredisk-csi-fips-1.28< 1.28.11-r7
azuredisk-csi-fips-1.29< 1.29.12-r3
azuredisk-csi-fips-1.30< 1.30.9-r1
azuredisk-csi-fips-1.31< 1.31.5-r0
bank-vaults< 1.20.4-r26
bank-vaults-fips< 1.20.4-r22
bank-vaults-template< 1.20.4-r26
bank-vaults-template-fips< 1.20.4-r22
beats-7< 7.17.28-r5
beats-fips-7< 7.17.28-r2
bom< 0.6.0-r17
buf< 1.50.1-r0
buildah< 1.39.2-r31
buildctl< 0.20.1-r1
buildctl-fips< 0.20.1-r1
buildkitd< 0.20.1-r1
buildkitd-fips< 0.20.1-r1
caddy< 2.9.1-r6
caddy-fips< 2.9.1-r6
caddy-man< 2.9.1-r6
caddy-src< 2.9.1-r6
cadvisor< 0.52.1-r2
cadvisor-compat< 0.52.1-r2
cadvisor-fips< 0.52.1-r2
calico-3.29< 3.29.2-r31
calico-apiserver-3.29< 3.29.2-r31
calico-apiserver-compat-3.29< 3.29.2-r31
calico-apiserver-fips-3.29< 3.29.2-r31
calico-app-policy-3.29< 3.29.2-r31
calico-app-policy-fips-3.29< 3.29.2-r31
calico-cni-3.29< 3.29.2-r31
calico-cni-compat-3.29< 3.29.2-r31
calico-cni-compat-fips-3.29< 3.29.2-r31
calico-cni-fips-3.29< 3.29.2-r31
calico-felix-3.29< 3.29.2-r31
calico-felix-fips-3.29< 3.29.2-r31
calico-fips-3.29< 3.29.2-r31
calico-key-cert-provisioner-3.29< 3.29.2-r31
calico-key-cert-provisioner-fips-3.29< 3.29.2-r31
calico-kube-controllers-3.29< 3.29.2-r31
calico-kube-controllers-fips-3.29< 3.29.2-r31
calico-node-3.29< 3.29.2-r31
calico-node-fips-3.29< 3.29.2-r31
calico-pod2daemon-3.29< 3.29.2-r31
calico-pod2daemon-fips-3.29< 3.29.2-r31
calico-pod2daemon-flexvol-compat-3.29< 3.29.2-r31
calico-typha-client-3.29< 3.29.2-r31
calico-typha-client-fips-3.29< 3.29.2-r31
calico-typhad-3.29< 3.29.2-r31
calico-typhad-fips-3.29< 3.29.2-r31
calicoctl-3.29< 3.29.2-r31
calicoctl-fips-3.29< 3.29.2-r31
cert-exporter< 2.14.0-r7
cert-exporter-fips< 2.14.0-r8
cert-manager-cmctl< 2.1.1-r7
cert-manager-cmctl-fips< 2.1.1-r6
cert-manager-fips-1.17< 1.17.1-r4
cert-manager-istio-csr< 0.14.0-r5
cert-manager-istio-csr-compat< 0.14.0-r5
cert-manager-webhook-pdns< 2.5.2-r2
cert-manager-webhook-pdns-fips< 2.5.2-r1
certificate-transparency< 1.3.1-r5
certificate-transparency-fips< 1.3.1-r3
certificate-transparency-fips-trillian-ctserver< 1.3.1-r3
certificate-transparency-trillian-ctserver< 1.3.1-r5
cfssl< 1.6.5-r16
cfssl-bundle< 1.6.5-r16
cfssl-bundle-fips< 1.6.5-r8
cfssl-certinfo< 1.6.5-r16
cfssl-certinfo-fips< 1.6.5-r8
cfssl-fips< 1.6.5-r8
cfssl-json< 1.6.5-r16
cfssl-json-fips< 1.6.5-r8
cfssl-mkbundle< 1.6.5-r16
cfssl-mkbundle-fips< 1.6.5-r8
cfssl-multirootca< 1.6.5-r16
cfssl-multirootca-fips< 1.6.5-r8
cfssl-newkey< 1.6.5-r16
cfssl-newkey-fips< 1.6.5-r8
cfssl-scan< 1.6.5-r16
cfssl-scan-fips< 1.6.5-r8
chartmuseum< 0.16.2-r13
chartmuseum-fips< 0.16.2-r10
chezmoi< 2.60.1-r0
cilium-1.15< 1.15.14-r21 | < 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.14-r21
cilium-1.15-container-init< 1.15.14-r21
cilium-1.15-container-init-compat< 1.15.14-r21
cilium-1.15-hubble-relay< 1.15.14-r21
cilium-1.15-iptables< 1.15.14-r21
cilium-1.15-operator-aws< 1.15.14-r21
cilium-1.15-operator-generic< 1.15.14-r21
cilium-1.16< 1.16.7-r21
cilium-1.16-clustermesh-apiserver< 1.16.7-r21
cilium-1.16-container-init< 1.16.7-r21
cilium-1.16-container-init-compat< 1.16.7-r21
cilium-1.16-hubble-relay< 1.16.7-r21
cilium-1.16-iptables< 1.16.7-r21
cilium-1.16-operator-aws< 1.16.7-r21
cilium-1.16-operator-generic< 1.16.7-r21
cilium-1.17< 1.17.2-r0
cilium-1.17-clustermesh-apiserver< 1.17.2-r0
cilium-1.17-container-init< 1.17.2-r0
cilium-1.17-container-init-compat< 1.17.2-r0
cilium-1.17-hubble-relay< 1.17.2-r0
cilium-1.17-iptables< 1.17.2-r0
cilium-1.17-operator-aws< 1.17.2-r0
cilium-1.17-operator-generic< 1.17.2-r0
cilium-cli< 0.18.2-r1
cilium-fips-1.15< 1.15.14-r4
cilium-fips-1.15-clustermesh-apiserver< 1.15.14-r4
cilium-fips-1.15-container-init< 1.15.14-r4
cilium-fips-1.15-container-init-compat< 1.15.14-r4
cilium-fips-1.15-host-utils< 1.15.14-r4
cilium-fips-1.15-hubble-relay< 1.15.14-r4
cilium-fips-1.15-operator-aws< 1.15.14-r4
cilium-fips-1.15-operator-azure< 1.15.14-r4
cilium-fips-1.15-operator-generic< 1.15.14-r4
cilium-fips-1.16< 1.16.7-r3
cilium-fips-1.16-clustermesh-apiserver< 1.16.7-r3
cilium-fips-1.16-container-init< 1.16.7-r3
cilium-fips-1.16-container-init-compat< 1.16.7-r3
cilium-fips-1.16-host-utils< 1.16.7-r3
cilium-fips-1.16-hubble-relay< 1.16.7-r3
cilium-fips-1.16-operator-aws< 1.16.7-r3
cilium-fips-1.16-operator-azure< 1.16.7-r3
cilium-fips-1.16-operator-generic< 1.16.7-r3
cilium-fips-1.17< 1.17.2-r0
cilium-fips-1.17-clustermesh-apiserver< 1.17.2-r0
cilium-fips-1.17-container-init< 1.17.2-r0
cilium-fips-1.17-container-init-compat< 1.17.2-r0

Show all 199

Alpine1 product

rclone< 1.69.2-r0

2 vendors · 200 products · Showing 200 of 2165

References

49 links

go.dev/cl/652135ARTICLEREPORTFIXWEBPatch
go.dev/issue/71931ARTICLEREPORTFIXWEBIssue TrackingPatch
pkg.go.dev/vuln/GO-2025-3487AdvisoryREPORTWEBVendor Advisory
security.netapp.com/advisory/ntap-20250411-0010/AdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2025:3165Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2348367REPORT
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3165.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-22869REPORT
www.cve.org/CVERecord?id=CVE-2025-22869AdvisoryREPORT

Show all 49 references