CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

Analyzed

AliasesUBUNTU-CVE-2026-46598DEBIAN-CVE-2026-46598CGA-224w-7jq9-998x+4438 more

Published 22-05-2026Last modified 22-05-2026

Vulnerability summary

CVE-2026-46598 is a medium (CVSS 5.3) Improper Validation of Array Index vulnerability in golang crypto. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.41%

0%100%

Low · -0.10 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 58 · Related 59

OPENSUSE-SU-2026:10856-1 OPENSUSE-SU-2026:10949-1 OPENSUSE-SU-2026:10966-1 OPENSUSE-SU-2026:10967-1 OPENSUSE-SU-2026:11053-1 OPENSUSE-SU-2026:11126-1+53 more

Timeline

22-05-2026
PublishedVulnerability first disclosed.
22-05-2026
Last modifiedVulnerability information updated.

Description

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

Decrease -0.10 pp

From 0.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r53
actAll versions (No fix recorded)
actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)
ageAll versions (No fix recorded)

age-fips< 1.3.1-r11 | All versions (No fix recorded)
agentbeatAll versions (No fix recorded)
agentbeat-fipsAll versions (No fix recorded)
amassAll versions (No fix recorded)
amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-operatorAll versions (No fix recorded)
amazon-cloudwatch-agent-operator-fipsAll versions (No fix recorded)
amazon-ssm-agent< 3.3.4515.0-r2 | All versions (No fix recorded)
amazon-ssm-agent-ecs-execAll versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fipsAll versions (No fix recorded)
amazon-ssm-agent-fips< 3.3.4515.0-r3 | All versions (No fix recorded)
apache-exporterAll versions (No fix recorded)
apkoAll versions (No fix recorded)
apko-fipsAll versions (No fix recorded)
apm-server-8.19All versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-9.3All versions (No fix recorded)
apm-server-9.4All versions (No fix recorded)
apply-cve-bumpAll versions (No fix recorded)
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-3.4All versions (No fix recorded)
argo-cd-3.4-compatAll versions (No fix recorded)
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2All versions (No fix recorded)
argo-cd-fips-3.2-compatAll versions (No fix recorded)
argo-cd-fips-3.4All versions (No fix recorded)
argo-cd-fips-3.4-compatAll versions (No fix recorded)
argo-eventsAll versions (No fix recorded)
argo-events-fipsAll versions (No fix recorded)
argo-rolloutsAll versions (No fix recorded)
argo-workflow-controller-3.6< 3.6.19-r7
argo-workflow-controller-fips-3.6< 3.6.19-r9
argo-workflow-executor-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.6< 3.6.19-r9
argo-workflows-3.6< 3.6.19-r7
argo-workflows-fips-3.6< 3.6.19-r9
argocd-image-updaterAll versions (No fix recorded)
argocd-image-updater-fipsAll versions (No fix recorded)
atlantisAll versions (No fix recorded)
atlantis-fipsAll versions (No fix recorded)
atlas-1.0-fipsAll versions (No fix recorded)
atlas-1.1All versions (No fix recorded)
auditbeat-8.17< 8.17.10-r21
auditbeat-8.19< 8.19.16-r3
auditbeat-9.3< 9.3.5-r3
authserviceAll versions (No fix recorded)
authservice-fipsAll versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fipsAll versions (No fix recorded)
aws-otel-collectorAll versions (No fix recorded)
aws-otel-collector-fipsAll versions (No fix recorded)
azcopyAll versions (No fix recorded)
azcopy-fipsAll versions (No fix recorded)
azure-service-operatorAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
azure-vnet-cni< 1.8.7-r1 | All versions (No fix recorded)
azure-workload-identity-webhookAll versions (No fix recorded)
azuredisk-csi-1.32All versions (No fix recorded)
azuredisk-csi-1.33All versions (No fix recorded)
azuredisk-csi-1.34All versions (No fix recorded)
azuredisk-csi-fips-1.32All versions (No fix recorded)
azuredisk-csi-fips-1.33All versions (No fix recorded)
azuredisk-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33All versions (No fix recorded)
azurefile-csi-1.34All versions (No fix recorded)
azurefile-csi-1.35All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.33< 1.33.10-r1 | All versions (No fix recorded)
azurefile-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-fips-1.35All versions (No fix recorded)
backup-restore-operator-10.0< 10.0.4-r3
backup-restore-operator-7.0< 7.0.8-r0
backup-restore-operator-8.1< 8.1.4-r2
backup-restore-operator-9.0< 9.0.3-r4
backup-restore-operator-fips-10.0All versions (No fix recorded)
backup-restore-operator-fips-7.0All versions (No fix recorded)
backup-restore-operator-fips-8.1All versions (No fix recorded)
backup-restore-operator-fips-9.0All versions (No fix recorded)
bank-vaults-vault-operatorAll versions (No fix recorded)
bazeliskAll versions (No fix recorded)
blob-csi-1.26All versions (No fix recorded)
blob-csi-1.27All versions (No fix recorded)
blob-csi-fips-1.25All versions (No fix recorded) | < 1.25.10-r19
blob-csi-fips-1.26All versions (No fix recorded)
blob-csi-fips-1.27All versions (No fix recorded)
blobfuse2-fipsAll versions (No fix recorded)
boring-registryAll versions (No fix recorded)
boring-registry-fipsAll versions (No fix recorded)
buildah< 1.44.0-r0
buildah-fips< 1.44.0-r0
buildctl-fips< 0.30.0-r3
buildkitdAll versions (No fix recorded)
buildkitd-fipsAll versions (No fix recorded)
caddyAll versions (No fix recorded)
caddy-fipsAll versions (No fix recorded)
cadence-fipsAll versions (No fix recorded)
cadence-fips-serverAll versions (No fix recorded)
cadvisorAll versions (No fix recorded)
cadvisor-fipsAll versions (No fix recorded)
calico-apiserver-3.31All versions (No fix recorded)
calico-apiserver-3.32All versions (No fix recorded)
calico-apiserver-fips-3.32All versions (No fix recorded)
calico-app-policy-3.31All versions (No fix recorded)
calico-app-policy-3.32All versions (No fix recorded)
calico-app-policy-fips-3.30< 3.30.7-r8
calico-app-policy-fips-3.32All versions (No fix recorded)
calico-cni-3.31All versions (No fix recorded)
calico-cni-3.32All versions (No fix recorded)
calico-cni-fips-3.30< 3.30.7-r8
calico-cni-fips-3.32All versions (No fix recorded)
calico-felix-3.31All versions (No fix recorded)
calico-felix-3.32All versions (No fix recorded)
calico-felix-fips-3.30< 3.30.7-r8
calico-felix-fips-3.32All versions (No fix recorded)
calico-goldmane-fips-3.30< 3.30.7-r8
calico-kube-controllers-3.31All versions (No fix recorded)
calico-kube-controllers-3.32All versions (No fix recorded)
calico-kube-controllers-fips-3.30< 3.30.7-r8
calico-kube-controllers-fips-3.32All versions (No fix recorded)
calico-node-3.31All versions (No fix recorded)
calico-node-3.32All versions (No fix recorded)
calico-node-fips-3.30< 3.30.7-r8
calico-node-fips-3.32All versions (No fix recorded)
calico-typhad-3.31All versions (No fix recorded)
calico-typhad-3.32All versions (No fix recorded)
calico-typhad-fips-3.30< 3.30.7-r8
calico-typhad-fips-3.32All versions (No fix recorded)
calico-whisker-backend-3.31All versions (No fix recorded)
calico-whisker-backend-3.32All versions (No fix recorded)
calico-whisker-backend-fips-3.30< 3.30.7-r8
calico-whisker-backend-fips-3.32All versions (No fix recorded)
calicoctl-3.31All versions (No fix recorded)
calicoctl-3.32All versions (No fix recorded)
calicoctl-fips-3.30< 3.30.7-r8
calicoctl-fips-3.32All versions (No fix recorded)
cert-exporterAll versions (No fix recorded)
cert-manager-1.18All versions (No fix recorded)
cert-manager-1.20< 1.20.2-r7
cert-manager-cainjector-1.18All versions (No fix recorded)
cert-manager-cainjector-1.20< 1.20.2-r7
cert-manager-cainjector-fips-1.18All versions (No fix recorded)
cert-manager-cainjector-fips-1.19All versions (No fix recorded)
cert-manager-cainjector-fips-1.20All versions (No fix recorded)
cert-manager-cmctlAll versions (No fix recorded)
cert-manager-cmctl-fipsAll versions (No fix recorded)
cert-manager-controller-1.18All versions (No fix recorded)
cert-manager-controller-1.20< 1.20.2-r7
cert-manager-controller-fips-1.18All versions (No fix recorded)
cert-manager-controller-fips-1.19All versions (No fix recorded)
cert-manager-controller-fips-1.20All versions (No fix recorded)
cert-manager-csi-driverAll versions (No fix recorded)
cert-manager-csi-driver-fipsAll versions (No fix recorded)
cert-manager-fips-1.18All versions (No fix recorded)
cert-manager-fips-1.19All versions (No fix recorded)
cert-manager-fips-1.20All versions (No fix recorded)
cert-manager-google-cas-issuerAll versions (No fix recorded)
cert-manager-google-cas-issuer-fipsAll versions (No fix recorded)
cert-manager-istio-csrAll versions (No fix recorded)
cert-manager-istio-csr-fipsAll versions (No fix recorded)
cert-manager-openshift-routesAll versions (No fix recorded)
cert-manager-openshift-routes-fipsAll versions (No fix recorded)
cert-manager-startupapicheck-1.18All versions (No fix recorded)
cert-manager-startupapicheck-1.20< 1.20.2-r7
cert-manager-startupapicheck-fips-1.18All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.19All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.20All versions (No fix recorded)
cert-manager-webhook-1.18All versions (No fix recorded)
cert-manager-webhook-1.20< 1.20.2-r7
cert-manager-webhook-fips-1.18All versions (No fix recorded)
cert-manager-webhook-fips-1.19All versions (No fix recorded)
cert-manager-webhook-fips-1.20All versions (No fix recorded)
cert-manager-webhook-pdnsAll versions (No fix recorded)
cert-manager-webhook-pdns-fipsAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
certificate-transparency-trillian-ctserverAll versions (No fix recorded)
cfssl-bundle-fipsAll versions (No fix recorded)
cfssl-certinfo-fipsAll versions (No fix recorded)
cfssl-fipsAll versions (No fix recorded)
cfssl-mkbundle-fipsAll versions (No fix recorded)
cfssl-multirootca-fipsAll versions (No fix recorded)
cfssl-newkey-fipsAll versions (No fix recorded)
cfssl-scan-fipsAll versions (No fix recorded)
cgAll versions (No fix recorded)
chainctlAll versions (No fix recorded)
chainctl-fipsAll versions (No fix recorded)
chainloop-artifact-casAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 2854

References

10 links

go.dev/issue/79596REPORTWEBIssue Tracking
go.dev/cl/781360REPORTWEBFIXIssue Tracking
groups.google.com/g/golang-announce/c/a082jnz-LvIREPORTWEBMailing List
pkg.go.dev/vuln/GO-2026-5033REPORTWEBVendor Advisory
ubuntu.com/security/CVE-2026-46598REPORT
www.cve.org/CVERecord?id=CVE-2026-46598REPORT
security-tracker.debian.org/tracker/CVE-2026-46598Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46598.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-46598AdvisoryOval