CVE-2025-47914
Medium
False Positivegolang.org/x/crypto/ssh/agent package is a transitive dependency but its code paths
are never invoked during KrakenD operation. The dependency was upgraded as a precaution.Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.1.
Component
x/crypto/ssh/agent
Disclosed
Nov 21, 2025
x/crypto/ssh/agent package does not validate the size of messages when
processing new identity requests. A malformed message triggers an out-of-bounds read,
causing the program to panic. An unauthenticated attacker reachable over the network
can crash any service using the SSH agent. Fixed in golang.org/x/crypto v0.45.0.Stay up to date with KrakenD releases and important updates