Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 22 May 2026 04:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Fri, 22 May 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. | |
| Title | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-05-22T02:31:27.894Z
Reserved: 2026-05-15T17:35:00.813Z
Link: CVE-2026-46595
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-22T04:16:25.550
Modified: 2026-05-22T04:16:25.550
Link: CVE-2026-46595
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-22T04:30:25Z