News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2025-47914 Medium False Positive

x/crypto/ssh/agent: Panic via Malformed Identity Request Message

This CVE does not affect KrakenD

KrakenD does not implement or expose SSH agent functionality. The golang.org/x/crypto/ssh/agent package is a transitive dependency but its code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.1.

Component

x/crypto/ssh/agent

Disclosed

Nov 21, 2025

Description

Go’s x/crypto/ssh/agent package does not validate the size of messages when processing new identity requests. A malformed message triggers an out-of-bounds read, causing the program to panic. An unauthenticated attacker reachable over the network can crash any service using the SSH agent. Fixed in golang.org/x/crypto v0.45.0.

Stay up to date with KrakenD releases and important updates