CVE-2025-58181
Vulnerability Summary
Timeline
Description
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Trends
Current EPSS score: 0.56%• Percentile: 45%
Techniques & Countermeasures
- CWE-770•Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected Systems
- chainguard•aactl
< 0.4.12-r38
- chainguard•actions-runner-controller
< 0.13.0-r1
- chainguard•actions-runner-controller-compat
< 0.13.0-r1
- chainguard•actions-runner-controller-fips
< 0.13.0-r2
- chainguard•actions-runner-controller-fips-compat
< 0.13.0-r2
- chainguard•age
< 1.2.1-r9
- chainguard•age-fips
< 0
- chainguard•agentbeat
< 9.2.1-r1
- chainguard•agentbeat-fips
< 0
- chainguard•amass
< 5.0.1-r2
- chainguard•amazon-cloudwatch-agent
< 1.300062.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader
< 1.300062.0-r1
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 0
- chainguard•amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-cloudwatch-agent-operator
< 3.3.0-r2
- chainguard•amazon-cloudwatch-agent-operator-compat
< 3.3.0-r2
- chainguard•amazon-cloudwatch-agent-operator-fips
< 0
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 0
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 1.300062.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-ssm-agent
< 0
- chainguard•amazon-ssm-agent-ecs-exec
< 0
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 0
- chainguard•amazon-ssm-agent-fips
< 0
- chainguard•apache-exporter
< 1.0.11-r1
- chainguard•apisix-ingress-controller
< 1.8.4-r5
- chainguard•apisix-ingress-controller-compat
< 1.8.4-r5
- chainguard•apisix-ingress-controller-iamguarded-compat
< 1.8.4-r5
- chainguard•apm-server-7.17
< 7.17.29-r6
- chainguard•apm-server-7.17-compat
< 7.17.29-r6
- chainguard•apm-server-8.17
< 0
- chainguard•apm-server-8.17-compat
< 0
- chainguard•apm-server-8.18
< 8.18.8-r2
- chainguard•apm-server-8.19
< 8.19.7-r1
- chainguard•apm-server-8.19-compat
< 8.19.7-r1
- chainguard•apm-server-9.0
< 0
- chainguard•apm-server-9.0-compat
< 0
- chainguard•apm-server-9.1
< 9.1.7-r1
- chainguard•apm-server-9.1-compat
< 9.1.7-r1
- chainguard•apm-server-9.2
< 0
- chainguard•apm-server-9.2-compat
< 0
- chainguard•apm-server-fips-7.17
< 7.17.29-r6
- chainguard•apm-server-fips-7.17-compat
< 7.17.29-r6
- chainguard•apm-server-fips-8.17
< 8.17.10-r2
- chainguard•apm-server-fips-8.17-compat
< 8.17.10-r2
- chainguard•argo-cd-2.14-compat
< 2.14.21-r2 | < 2.14.21-r3
- chainguard•argo-cd-3.0
< 3.0.20-r3
- chainguard•argo-cd-3.0-compat
< 3.0.20-r3
Showing first 50 affected entries in server-rendered view.
References (16)
- https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
- https://go.dev/cl/721961
- https://go.dev/issue/76363
- https://pkg.go.dev/vuln/GO-2025-4134
- https://nvd.nist.gov/vuln/detail/CVE-2025-58181
- https://security-tracker.debian.org/tracker/CVE-2025-58181
- https://bugzilla.suse.com/1253784
- https://www.suse.com/security/cve/CVE-2025-58181
- https://ubuntu.com/security/CVE-2025-58181
- https://www.cve.org/CVERecord?id=CVE-2025-58181
- https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA?pli=1
- https://github.com/golang/go/issues/76363
- https://github.com/golang/crypto/commit/e79546e28b85ea53dd37afe1c4102746ef553b9c
- https://ubuntu.com/security/notices/USN-7956-1
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58181.json