CVE-2025-47913
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Nov 13, 2025
CISA due date
—
The record
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | golang.org/x/crypto | 0 | 0.43.0 |
| AlmaLinux:10 | buildah | 0 | 2:1.41.8-1.el10_1 |
| AlmaLinux:10 | buildah-tests | 0 | 2:1.41.8-1.el10_1 |
| AlmaLinux:10 | podman | 0 | 7:5.6.0-11.el10_1 |
| AlmaLinux:10 | podman-docker | 0 | 7:5.6.0-11.el10_1 |
| AlmaLinux:10 | podman-remote | 0 | 7:5.6.0-11.el10_1 |
| AlmaLinux:10 | podman-tests | 0 | 7:5.6.0-11.el10_1 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | buildah | 0 | 2:1.33.14-1.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.14-1.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | cockpit-podman | 0 | 84.1-1.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | container-selinux | 0 | 2:2.229.0-2.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-docker | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-gvproxy | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-27.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | python3-podman | 0 | 4.9.0-3.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | runc | 0 | 4:1.2.9-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | runc | 0 | 4:1.2.9-2.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-5.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-5.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-5.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-5.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-5.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-5.module_el8.10.0+4102+6c76e544 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+4090+91932338 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux:8 | udica | 0 | 0.2.6-21.module_el8.10.0+4068+0e21408f |
| AlmaLinux:9 | buildah | 0 | 2:1.41.8-1.el9_7 |
| AlmaLinux:9 | buildah-tests | 0 | 2:1.41.8-1.el9_7 |
| AlmaLinux:9 | podman | 0 | 6:5.6.0-11.el9_7 |
| AlmaLinux:9 | podman-docker | 0 | 6:5.6.0-11.el9_7 |
| AlmaLinux:9 | podman-plugins | 0 | 6:5.6.0-11.el9_7 |
| AlmaLinux:9 | podman-remote | 0 | 6:5.6.0-11.el9_7 |
| AlmaLinux:9 | podman-tests | 0 | 6:5.6.0-11.el9_7 |
| Chainguard | apm-server-9.0 | 0 | 0 |
| Chainguard | apm-server-9.0-compat | 0 | 0 |
| Chainguard | argo-cd-fips-2.13 | 0 | 2.13.9-r5 |
| Chainguard | argo-cd-fips-2.13-repo-server | 0 | 2.13.9-r5 |
| Chainguard | auditbeat-fips-8.17 | 0 | 0 |
| Chainguard | auditbeat-fips-8.18 | 0 | 0 |
| Chainguard | auditbeat-fips-9.0 | 0 | 0 |
| Chainguard | beats-fips-8.17 | 0 | 0 |
| Chainguard | beats-fips-8.18 | 0 | 0 |
| Chainguard | beats-fips-9.0 | 0 | 0 |
| Chainguard | cert-manager-acmesolver-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-acmesolver-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cert-manager-cainjector-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-cainjector-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cert-manager-controller-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-controller-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cert-manager-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cert-manager-startupapicheck-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-startupapicheck-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cert-manager-webhook-fips-1.17 | 0 | 0 |
| Chainguard | cert-manager-webhook-fips-1.19 | 0 | 1.19.2-r0 |
| Chainguard | cilium-fips-1.15 | 0 | 0 |
| Chainguard | cilium-fips-1.15-clustermesh-apiserver | 0 | 0 |
| Chainguard | cilium-fips-1.15-container-init | 0 | 0 |
| Chainguard | cilium-fips-1.15-container-init-compat | 0 | 0 |
| Chainguard | cilium-fips-1.15-host-utils | 0 | 0 |
| Chainguard | cilium-fips-1.15-hubble-relay | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-aws | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-azure | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-generic | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28 | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28-cloud-controller-manager-compat | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28-ecr-credential-provider | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31 | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager-compat | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-ecr-credential-provider | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.28 | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.28-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.28-ecr-credential-provider | 0 | 0 |
| Chainguard | consul-k8s-1.6 | 0 | 1.6.10-r4 |
| Chainguard | consul-k8s-1.6-cli | 0 | 1.6.10-r4 |
| Chainguard | dex-k8s-authenticator | 0 | 0 |
| Chainguard | dkron | 0 | 4.0.9-r0 |
| Chainguard | dkron-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-gcppubsub | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-gcppubsub-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-grpc | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-grpc-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-kafka | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-kafka-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-nats | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-nats-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-rabbitmq | 0 | 4.0.9-r0 |
| Chainguard | dkron-executor-rabbitmq-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-fips | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-gcppubsub | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-gcppubsub-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-grpc | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-grpc-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-kafka | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-kafka-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-nats | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-nats-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-rabbitmq | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-executor-rabbitmq-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-files | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-files-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-fluent | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-fluent-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-log | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-log-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-syslog | 0 | 4.0.8-r5 |
| Chainguard | dkron-fips-processor-syslog-compat | 0 | 4.0.8-r5 |
| Chainguard | dkron-processor-files | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-files-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-fluent | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-fluent-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-log | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-log-compat | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-syslog | 0 | 4.0.9-r0 |
| Chainguard | dkron-processor-syslog-compat | 0 | 4.0.9-r0 |
| Chainguard | eks-distro-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-1.30 | 0 | 0 |
| Chainguard | eks-distro-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-1.34 | 0 | 0 |
| Chainguard | eks-distro-coredns-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-coredns-1.30 | 0 | 0 |
| Chainguard | eks-distro-coredns-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-coredns-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-coredns-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-coredns-1.34 | 0 | 0 |
| Chainguard | eks-distro-coredns-fips-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-coredns-fips-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-coredns-fips-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-coredns-fips-1.32 | 0 | 1.32.31-r0 |
Related vulnerabilities
- CVE-2025-47914 golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of… Also affects golang.org/x/crypto
- CVE-2025-58181 golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption Also affects golang.org/x/crypto
- CVE-2024-45337 Applications and libraries which misuse connection.serverAuthenticate (via callback field… Also affects golang.org/x/crypto
- CVE-2023-48795 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… Also affects golang.org/x/crypto
- CVE-2021-43565 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto… Also affects golang.org/x/crypto
- CVE-2022-27191 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… Also affects golang.org/x/crypto
- CVE-2020-9283 golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic… Also affects golang.org/x/crypto
- CVE-2025-52881 runc container escape and denial of service due to arbitrary write gadgets and procfs… Also affects buildah