x/crypto/ssh: Memory Exhaustion via Unbounded GSSAPI Mechanism Count

This CVE does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh package is a transitive dependency but its SSH code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.1.

Component

x/crypto/ssh

Disclosed

Nov 21, 2025

Description

SSH servers using Go’s x/crypto/ssh package do not validate the number of mechanisms specified in a GSSAPI authentication request. An unauthenticated attacker can send a crafted request with an unbounded mechanism list, causing uncontrolled memory allocation and exhausting server resources (DoS). Fixed in golang.org/x/crypto v0.45.0.

References

View CVE-2025-58181 on NVD

Stay up to date with KrakenD releases and important updates