CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Analyzed

AliasesUBUNTU-CVE-2026-46597DEBIAN-CVE-2026-46597CGA-2238-qqq3-5qpp+4506 more

Published 22-05-2026Last modified 22-05-2026

Vulnerability summary

CVE-2026-46597 is a high (CVSS 7.5) Incorrect Type Conversion or Cast vulnerability in golang crypto. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 41% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 04-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.47%

0%100%

Low · -0.15 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 57 · Related 58

OPENSUSE-SU-2026:10843-1 OPENSUSE-SU-2026:10856-1 OPENSUSE-SU-2026:10858-1 OPENSUSE-SU-2026:10889-1 OPENSUSE-SU-2026:10949-1 OPENSUSE-SU-2026:11126-1+52 more

Timeline

22-05-2026
PublishedVulnerability first disclosed.
22-05-2026
Last modifiedVulnerability information updated.

Description

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

Decrease -0.15 pp

From 0.62% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r53
act< 0.2.88-r6
actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)
ageAll versions (No fix recorded)

age-fipsAll versions (No fix recorded) | < 1.3.1-r11
agentbeat< 9.2.7-r11
agentbeat-fips< 9.2.7-r10
amassAll versions (No fix recorded)
amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-operatorAll versions (No fix recorded)
amazon-cloudwatch-agent-operator-fipsAll versions (No fix recorded)
amazon-ssm-agent< 3.3.4515.0-r2
amazon-ssm-agent-ecs-exec< 3.3.4515.0-r2
amazon-ssm-agent-ecs-exec-fips< 3.3.4515.0-r3
amazon-ssm-agent-fips< 3.3.4515.0-r3
apache-exporterAll versions (No fix recorded)
apko< 1.2.14-r2
apko-fips< 1.2.14-r2
apm-server-8.19All versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-9.3All versions (No fix recorded)
apm-server-9.4All versions (No fix recorded)
apply-cve-bump< 0.2.280-r0
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-3.4< 3.4.2-r4
argo-cd-3.4-compat< 3.4.2-r4
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2< 3.2.12-r5
argo-cd-fips-3.2-compat< 3.2.12-r5
argo-cd-fips-3.4< 3.4.2-r4
argo-cd-fips-3.4-compat< 3.4.2-r4
argo-events< 1.9.10-r24
argo-events-fips< 1.9.10-r17
argo-rolloutsAll versions (No fix recorded)
argo-workflow-controller-3.6< 3.6.19-r7
argo-workflow-controller-fips-3.6< 3.6.19-r9
argo-workflow-executor-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.6< 3.6.19-r9
argo-workflows-3.6< 3.6.19-r7
argo-workflows-fips-3.6< 3.6.19-r9
argocd-image-updater< 1.2.1-r2
argocd-image-updater-fips< 1.2.1-r1
atlantis< 0.43.0-r4
atlantis-fips< 0.43.0-r6
atlas-1.0-fipsAll versions (No fix recorded)
atlas-1.1All versions (No fix recorded)
auditbeat-8.17< 8.17.10-r21
auditbeat-8.19< 8.19.16-r3
auditbeat-9.3< 9.3.5-r3
authserviceAll versions (No fix recorded)
authservice-fipsAll versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fipsAll versions (No fix recorded)
aws-otel-collectorAll versions (No fix recorded)
aws-otel-collector-fipsAll versions (No fix recorded)
azcopyAll versions (No fix recorded)
azcopy-fipsAll versions (No fix recorded)
azure-service-operatorAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
azure-vnet-cni< 1.8.7-r1 | All versions (No fix recorded)
azure-workload-identity-webhookAll versions (No fix recorded)
azuredisk-csi-1.32All versions (No fix recorded)
azuredisk-csi-1.33All versions (No fix recorded)
azuredisk-csi-1.34All versions (No fix recorded)
azuredisk-csi-fips-1.32All versions (No fix recorded)
azuredisk-csi-fips-1.33All versions (No fix recorded)
azuredisk-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33All versions (No fix recorded)
azurefile-csi-1.34All versions (No fix recorded)
azurefile-csi-1.35All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.33All versions (No fix recorded) | < 1.33.10-r1
azurefile-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-fips-1.35All versions (No fix recorded)
backup-restore-operator-10.0< 10.0.4-r3
backup-restore-operator-7.0< 7.0.8-r0
backup-restore-operator-8.1< 8.1.4-r2
backup-restore-operator-9.0< 9.0.3-r4
backup-restore-operator-fips-10.0All versions (No fix recorded)
backup-restore-operator-fips-7.0All versions (No fix recorded)
backup-restore-operator-fips-8.1All versions (No fix recorded)
backup-restore-operator-fips-9.0All versions (No fix recorded)
bank-vaults-vault-operatorAll versions (No fix recorded)
bazeliskAll versions (No fix recorded)
blob-csi-1.26All versions (No fix recorded)
blob-csi-1.27All versions (No fix recorded)
blob-csi-fips-1.25< 1.25.10-r19 | All versions (No fix recorded)
blob-csi-fips-1.26All versions (No fix recorded)
blob-csi-fips-1.27All versions (No fix recorded)
blobfuse2-fipsAll versions (No fix recorded)
boring-registryAll versions (No fix recorded)
boring-registry-fipsAll versions (No fix recorded)
buildah< 1.44.0-r0
buildah-fips< 1.44.0-r0
buildctl-fips< 0.30.0-r3
buildkitd< 0.30.0-r2
buildkitd-fips< 0.30.0-r3
caddy< 2.11.3-r2
caddy-fips< 2.11.3-r3
cadence-fipsAll versions (No fix recorded)
cadence-fips-serverAll versions (No fix recorded)
cadvisorAll versions (No fix recorded)
cadvisor-fipsAll versions (No fix recorded)
calico-apiserver-3.31All versions (No fix recorded)
calico-apiserver-3.32All versions (No fix recorded)
calico-apiserver-fips-3.32All versions (No fix recorded)
calico-app-policy-3.31All versions (No fix recorded)
calico-app-policy-3.32All versions (No fix recorded)
calico-app-policy-fips-3.30< 3.30.7-r8
calico-app-policy-fips-3.32All versions (No fix recorded)
calico-cni-3.31All versions (No fix recorded)
calico-cni-3.32All versions (No fix recorded)
calico-cni-fips-3.30< 3.30.7-r8
calico-cni-fips-3.32All versions (No fix recorded)
calico-felix-3.31All versions (No fix recorded)
calico-felix-3.32All versions (No fix recorded)
calico-felix-fips-3.30< 3.30.7-r8
calico-felix-fips-3.32All versions (No fix recorded)
calico-goldmane-fips-3.30< 3.30.7-r8
calico-kube-controllers-3.31All versions (No fix recorded)
calico-kube-controllers-3.32All versions (No fix recorded)
calico-kube-controllers-fips-3.30< 3.30.7-r8
calico-kube-controllers-fips-3.32All versions (No fix recorded)
calico-node-3.31All versions (No fix recorded)
calico-node-3.32All versions (No fix recorded)
calico-node-fips-3.30< 3.30.7-r8
calico-node-fips-3.32All versions (No fix recorded)
calico-typhad-3.31All versions (No fix recorded)
calico-typhad-3.32All versions (No fix recorded)
calico-typhad-fips-3.30< 3.30.7-r8
calico-typhad-fips-3.32All versions (No fix recorded)
calico-whisker-backend-3.31All versions (No fix recorded)
calico-whisker-backend-3.32All versions (No fix recorded)
calico-whisker-backend-fips-3.30< 3.30.7-r8
calico-whisker-backend-fips-3.32All versions (No fix recorded)
calicoctl-3.31All versions (No fix recorded)
calicoctl-3.32All versions (No fix recorded)
calicoctl-fips-3.30< 3.30.7-r8
calicoctl-fips-3.32All versions (No fix recorded)
cert-exporterAll versions (No fix recorded)
cert-manager-1.18All versions (No fix recorded)
cert-manager-1.20< 1.20.2-r7
cert-manager-cainjector-1.18All versions (No fix recorded)
cert-manager-cainjector-1.20< 1.20.2-r7
cert-manager-cainjector-fips-1.18All versions (No fix recorded)
cert-manager-cainjector-fips-1.19All versions (No fix recorded)
cert-manager-cainjector-fips-1.20All versions (No fix recorded)
cert-manager-cmctlAll versions (No fix recorded)
cert-manager-cmctl-fipsAll versions (No fix recorded)
cert-manager-controller-1.18All versions (No fix recorded)
cert-manager-controller-1.20< 1.20.2-r7
cert-manager-controller-fips-1.18All versions (No fix recorded)
cert-manager-controller-fips-1.19< 1.19.5-r5
cert-manager-controller-fips-1.20< 1.20.2-r4
cert-manager-csi-driverAll versions (No fix recorded)
cert-manager-csi-driver-fipsAll versions (No fix recorded)
cert-manager-fips-1.18All versions (No fix recorded)
cert-manager-fips-1.19All versions (No fix recorded) | < 1.19.5-r5
cert-manager-fips-1.20< 1.20.2-r4 | All versions (No fix recorded)
cert-manager-google-cas-issuerAll versions (No fix recorded)
cert-manager-google-cas-issuer-fipsAll versions (No fix recorded)
cert-manager-istio-csrAll versions (No fix recorded)
cert-manager-istio-csr-fipsAll versions (No fix recorded)
cert-manager-openshift-routesAll versions (No fix recorded)
cert-manager-openshift-routes-fipsAll versions (No fix recorded)
cert-manager-startupapicheck-1.18All versions (No fix recorded)
cert-manager-startupapicheck-1.20< 1.20.2-r7
cert-manager-startupapicheck-fips-1.18All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.19All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.20All versions (No fix recorded)
cert-manager-webhook-1.18All versions (No fix recorded)
cert-manager-webhook-1.20< 1.20.2-r7
cert-manager-webhook-fips-1.18All versions (No fix recorded)
cert-manager-webhook-fips-1.19All versions (No fix recorded)
cert-manager-webhook-fips-1.20All versions (No fix recorded)
cert-manager-webhook-pdnsAll versions (No fix recorded)
cert-manager-webhook-pdns-fipsAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
certificate-transparency-trillian-ctserverAll versions (No fix recorded)
cfssl-bundle-fipsAll versions (No fix recorded)
cfssl-certinfo-fipsAll versions (No fix recorded)
cfssl-fipsAll versions (No fix recorded)
cfssl-mkbundle-fipsAll versions (No fix recorded)
cfssl-multirootca-fipsAll versions (No fix recorded)
cfssl-newkey-fipsAll versions (No fix recorded)
cfssl-scan-fipsAll versions (No fix recorded)
cg< 0.2.266-r1
chainctl< 0.2.266-r1
chainctl-fips< 0.2.266-r1
chainloop-artifact-casAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 2860

References

11 links

go.dev/issue/79561REPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/a082jnz-LvIREPORTWEBMailing List
go.dev/cl/781620REPORTWEBFIXIssue Tracking
pkg.go.dev/vuln/GO-2026-5013REPORTWEBVendor Advisory
ubuntu.com/security/CVE-2026-46597REPORT
www.cve.org/CVERecord?id=CVE-2026-46597REPORT
security-tracker.debian.org/tracker/CVE-2026-46597Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46597.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-46597AdvisoryOval

Show all 11 references

cs.opensource.google/go/x/cryptoPACKAGE