CVE catalog

CVE-2026-39832

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwardi

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.68% · Oct 25, 2026

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-go.cryptosid1:0.58.0-1fixed
Debiangolang-go.cryptoforky1:0.58.0-1fixed
Debiangolang-go.cryptotrixie1:0.25.0-1vulnerable
Debiangolang-go.cryptobookworm1:0.4.0-1vulnerable
Cpegolang-go.cryptoNot reportedNot reportedvulnerable
CpecryptoNot reported0.52.0fixed
Gogolang.org/x/cryptoNot reported0.52.0fixed
CpecryptoNot reported0.52.0fixed
Gogolang.org/x/cryptoNot reported0.52.0fixed
Ubuntulxdpro2.18-0ubuntu6vulnerable
Ubuntulxdpro2.19-0ubuntu1vulnerable
Ubuntulxdpro2.20-0ubuntu3vulnerable
Ubuntulxdpro2.20-0ubuntu4vulnerable
Ubuntulxdpro2.21-0ubuntu1vulnerable
Ubuntulxdpro2.21-0ubuntu2vulnerable
Ubuntulxdpro2.21-0ubuntu3vulnerable
Ubuntulxdpro2.21-0ubuntu4vulnerable
Ubuntulxdpro3.0.0~beta2-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta3-0ubuntu3vulnerable
Ubuntulxdpro3.0.0~beta5-0ubuntu2vulnerable
Ubuntulxdpro3.0.0~beta7-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu1vulnerable
Ubuntulxdpro3.0.0-0ubuntu2vulnerable
Ubuntulxdpro3.0.0-0ubuntu3vulnerable
Ubuntulxdpro3.0.0-0ubuntu4vulnerable
Ubuntulxdpro3.0.1-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.2-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm1vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm2vulnerable
Ubuntulxdpro3.0.3-0ubuntu1~18.04.2+esm3vulnerable
Ubuntusnapdpro2.41+19.10.1vulnerable
Ubuntusnapdpro2.42.1+20.04vulnerable
Ubuntusnapdpro2.43.3+git1.8109f8vulnerable
Ubuntusnapdpro2.44~pre1+20.04vulnerable
Ubuntusnapdpro2.44+20.04vulnerable
Ubuntusnapdpro2.44.2+20.04vulnerable
Ubuntusnapdpro2.44.3+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04.2vulnerable
Ubuntusnapdpro2.46.1+20.04vulnerable
Ubuntusnapdpro2.47.1+20.04vulnerable
Ubuntusnapdpro2.48+20.04vulnerable
Ubuntusnapdpro2.48.3+20.04vulnerable
Ubuntusnapdpro2.49.2+20.04vulnerable
Ubuntusnapdpro2.51.1+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.2+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.3+20.04vulnerable
Ubuntusnapdpro2.54.3+20.04.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.2vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.3vulnerable
Ubuntusnapdpro2.55.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.58+20.04vulnerable
Ubuntusnapdpro2.58+20.04.1vulnerable
Ubuntusnapdpro2.61.3+20.04vulnerable
Ubuntusnapdpro2.62+20.04vulnerable
Ubuntusnapdpro2.63+20.04vulnerable
Ubuntusnapdpro2.63+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.65.3+20.04vulnerable
Ubuntusnapdpro2.66.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm1vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm3vulnerable
Ubuntugolang-go.cryptopro1:0.25.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.45.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1vulnerable
Ubuntugolang-go.cryptopro1:0.47.0-1ubuntu0.1~esm1fixed
Ubuntusnapd22.042.53+21.10ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu2vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu3vulnerable
Ubuntusnapd22.042.54.3+git19.g868fc21+22.04vulnerable
Ubuntusnapd22.042.54.3+git26.g360067e+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04.1vulnerable
Ubuntusnapd22.042.55.3+22.04vulnerable
Ubuntusnapd22.042.55.3+22.04ubuntu1vulnerable
Ubuntusnapd22.042.55.5+22.04vulnerable
Ubuntusnapd22.042.56.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.57.4+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.58+22.04vulnerable
Ubuntusnapd22.042.58+22.04.1vulnerable
Ubuntusnapd22.042.61.3+22.04vulnerable
Ubuntusnapd22.042.62+22.04vulnerable
Ubuntusnapd22.042.63+22.04vulnerable
Ubuntusnapd22.042.63+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.65.3+22.04vulnerable
Ubuntusnapd22.042.66.1+22.04vulnerable
Ubuntusnapd22.042.67.1+22.04vulnerable
Ubuntusnapd22.042.68.5+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.71+ubuntu22.04vulnerable
Ubuntusnapd22.042.72+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.74.1+ubuntu22.04.4vulnerable
Ubuntusnapd22.042.75.2+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04vulnerable
Ubuntusnapd22.042.76.3+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.77.1+ubuntu22.04.1vulnerable
Ubuntusnapd24.042.60.4+23.10vulnerable
Ubuntusnapd24.042.61.3+24.04vulnerable
Ubuntusnapd24.042.62+24.04build1vulnerable
Ubuntusnapd24.042.63+24.04vulnerable
Ubuntusnapd24.042.63+24.04ubuntu0.1vulnerable
Ubuntusnapd24.042.63.1+24.04vulnerable
Ubuntusnapd24.042.65.3+24.04vulnerable
Ubuntusnapd24.042.66.1+24.04vulnerable
Ubuntusnapd24.042.67.1+24.04vulnerable
Ubuntusnapd24.042.68.5+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.71+ubuntu24.04vulnerable
Ubuntusnapd24.042.72+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.2vulnerable
Ubuntusnapd24.042.74.1+ubuntu24.04.4vulnerable
Ubuntusnapd24.042.75.2+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.76.3+ubuntu24.04vulnerable
Ubuntusnapd24.042.77.1+ubuntu24.04vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1vulnerable
Ubuntugolang-go.crypto25.101:0.25.0-1ubuntu0.1vulnerable
Ubuntusnapd25.102.67.1+25.04vulnerable
Ubuntusnapd25.102.68.5+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.71+ubuntu25.10vulnerable
Ubuntusnapd25.102.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.72+ubuntu25.10.2vulnerable
Ubuntusnapd25.102.73+ubuntu25.10vulnerable
Ubuntusnapd25.102.73+ubuntu25.10.1vulnerable
Ubuntusnapd25.102.74.1+ubuntu25.10.4vulnerable
Ubuntusnapd25.102.75.2+ubuntu25.10vulnerable
Ubuntusnapd26.102.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.1vulnerable
Ubuntusnapd26.102.76+ubuntu26.10.2vulnerable
Ubuntusnapd26.102.76.3+ubuntu26.10vulnerable
Ubuntusnapd26.102.77.1+ubuntu26.10.1vulnerable
Ubuntusnapd26.042.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd26.042.72+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.73+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.74+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.042.75.2+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.76.3+ubuntu26.04vulnerable
Ubuntusnapd26.042.77.1+ubuntu26.04.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-go.cryptosourcesid1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourceforky1:0.52.0-1not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcetrixie(unfixed)not yet assignedNot reported[1137516]
Debiangolang-go.cryptosourcebookworm(unfixed)not yet assignedNot reported[1137516]
CpecryptocpeNot reported0.52.0Not reportedNot reportedNot reported
Gogolang.org/x/cryptoGoNot reported0.52.0Not reportedGHSA-F5WC-C3C7-36MCNot reported
CpecryptocpeNot reported0.52.0Not reportedNVD-CVE-2026-39832Not reported
Gogolang.org/x/cryptoGoNot reported0.52.0Not reportedGO-2026-5006Not reported
Ubuntugolang-go.cryptodebpro1:0.47.0-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-39832Not reported

[Debian bug #1137516]

Notes

[trixie] golang-go.crypto: Minor issue [bookworm] golang-go.crypto: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-golang-x-crypto-dev]Affected

    Source package: [golang-go.crypto]

    Details (4)

    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.4.0-1 · all · bookworm

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

    • 1:0.25.0-1~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-go.crypto · debian · bookworm; nvd · golang-go.crypto · debian · 12

[Debian 13 (Trixie)]

  • [golang-golang-x-crypto-dev]Affected

    Source package: [golang-go.crypto]

    Details (4)

    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.25.0-1 · all · trixie

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

    • 1:0.52.0-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-go.crypto · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]