CVE-2026-39835

Description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Overview

State: PUBLISHED
Assigner (CNA): Go
CVSS severity: high
CVSS score: 7.5 / 10
CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Effective score: 7.5 / 10 HIGH source: CNA overview
MSRC score: 5.3 / 10 MEDIUM MS rating: Moderate
CWE(s): CWE-476: NULL Pointer Dereference
Reserved: 2026-04-07
Published: 2026-05-22 02:31 UTC
Last updated: 2026-05-22 17:45 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39835.json
Linked Threat: CVE-2026-39835 — CVE-2026-39835

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-22 04:16:24 UTC
NVD last modified: 2026-05-22 04:16:24 UTC
EPSS score: 0.0002 (probability of exploitation in next 30 days)
EPSS percentile: 5.54% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-31393
Assigner: Go
Published: May 22, 2026, 2:31:26 AM
Updated: May 22, 2026, 5:45:10 PM
EUVD base score (CVSS 3.1): 5.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EUVD-reported EPSS: 0.0300
Vendors: golang.org/x/crypto
Products: golang.org/x/crypto/ssh (0 <0.52.0)

ENISA description: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

EUVD references (4)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-28 03:00 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 5.3 / 10 (temporal 4.9)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U
Release: 2026-May

Microsoft remediations / KB articles (2)

CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 1.12.15-8)
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases

Affected products (1)

Vendor	Product	Versions	Platforms
golang.org/x/crypto	golang.org/x/crypto/ssh	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (9)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
MSRC update guide: CVE-2026-39835 msrc
https://www.first.org/epss/ tenable:www.first.org
https://groups.google.com/g/golang-announce/c/a082jnz-LvI tenable:groups.google.com
https://go.dev/issue/79563 tenable:go.dev
https://nvd.nist.gov/vuln/detail/CVE-2026-39835 tenable:nvd.nist.gov
https://pkg.go.dev/vuln/GO-2026-5015 tenable:pkg.go.dev
https://www.cve.org/CVERecord?id=CVE-2026-39835 tenable:www.cve.org
https://go.dev/cl/781660 tenable:go.dev

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://go.dev/cl/781660 security@golang.org
https://go.dev/issue/79563 security@golang.org
https://groups.google.com/g/golang-announce/c/a082jnz-LvI security@golang.org
https://pkg.go.dev/vuln/GO-2026-5015 security@golang.org

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Advisory Bulletin 064 | Ubiquiti Community

web:community.ui.com

Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

2026-05-26 03:00 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-05-26 03:00 UTC
NVD - Vulnerabilities

web:nvd.nist.gov

Vulnerabilities All vulnerabilities in the NVD have been assigned a CVE identifier and thus, abide by the definition below. CVE defines a vulnerability as: "A weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this ...

2026-05-26 03:00 UTC
Android Security Bulletin—May 2026 - Android Open Source Project

web:source.android.com

Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level. Devices that use the 2026 -05-01 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.

2026-05-26 03:00 UTC
About the security content of iOS 26.5 and iPadOS 26.5

web:support.apple.com

This document describes the security content of iOS 26.5 and iPadOS 26.5.

2026-05-26 03:00 UTC
Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...

web:support.servicenow.com

Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

2026-05-26 03:00 UTC
CVE-2026-39350 | Medium Vulnerability in Istio

web:www.appsecure.security

CVE - 2026 -39350 CVE - 2026 -39350: Medium Vulnerability in Istio A medium severity vulnerability has been identified in Istio affecting specific versions. This vulnerability allows incorrect interpretation of AuthorizationPolicy rules, potentially leading to unintended access control issues. Organizations are advised to patch promptly.

2026-05-26 03:00 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-26 03:00 UTC
VirusTotal - Home

web:www.virustotal.com

VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.

2026-05-26 03:00 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-26 03:00 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-39835.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39835",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T17:44:50.320380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T17:45:10.853Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "CertChecker.CheckHostKey"
            },
            {
              "name": "CertChecker.Authenticate"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.52.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "NCC Group Cryptography Services, sponsored by Teleport"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T02:31:26.982Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79563"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "url": "https://go.dev/cl/781660"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5015"
        }
      ],
      "title": "Invoking  server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-39835",
    "datePublished": "2026-05-22T02:31:26.982Z",
    "dateReserved": "2026-04-07T18:13:03.529Z",
    "dateUpdated": "2026-05-22T17:45:10.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}