Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-39833

  CVE-2026-39833: golang.org/x/crypto ssh/agent ConfirmBeforeUse Constraint Bypass

  The Go SSH agent keyring silently ignored the 'require user confirmation' flag on stored keys, letting any process with agent access sign with those keys without ever prompting the user.

• highCVE-2026-48508

  CVE-2026-48508: Lemur Authorization Bypass via Empty Flask-Principal Need Set

  A read-only user in Netflix Lemur can create root Certificate Authorities, upload arbitrary certificates, and manipulate notifications because two permission classes default to an empty Need set…

• highCVE-2026-53461

  CVE-2026-53461: ImageMagick ICON Decoder Heap Out-of-Bounds Write

  A loop bug in ImageMagick's ICON decoder lets a crafted .ICO file write past the end of a heap buffer, crashing any application that processes untrusted icons.

• highCVE-2026-49218

  CVE-2026-49218: Magick.NET DCM Decoder Invalid Dimension Denial of Service

  A crafted DICOM medical image file with zero-value dimension fields can bypass ImageMagick's input validation, producing an image with no width or height that crashes any downstream operation that…

• highCVE-2026-53460

  CVE-2026-53460: Magick.NET (ImageMagick) AcquireAlignedMemory Policy Bypass DoS

  A missing bounds check in ImageMagick's aligned memory allocator lets a crafted image bypass the operator-configured memory cap and exhaust process memory, crashing any application that processes…

• criticalCVE-2026-42508

  CVE-2026-42508: golang.org/x/crypto/ssh/knownhosts CA Revocation Bypass

  A bug in Go's SSH known_hosts library meant that a revoked CA signing key was never actually checked for revocation, letting an attacker impersonate any SSH host that CA had ever certified.

• criticalCVE-2026-39834

  CVE-2026-39834: golang.org/x/crypto/ssh Infinite Loop via Integer Overflow on Large Channel Write

  Integer overflow in golang.org/x/crypto/ssh channel.Write allows a caller to trigger an infinite loop by passing a single buffer >4 GiB, causing CPU exhaustion (DoS).

• criticalCVE-2026-46595

  CVE-2026-46595: golang.org/x/crypto/ssh VerifiedPublicKeyCallback Source-Address Authorization Bypass

  golang.org/x/crypto/ssh < 0.52.0 skips source-address enforcement when VerifiedPublicKeyCallback is set, allowing auth from blocked IPs. CVSS 10.

• criticalCVE-2026-39830

  CVE-2026-39830: golang.org/x/crypto/ssh Server Deadlock via Unsolicited Global Response

  Malicious SSH peer sends unsolicited MSG_REQUEST_SUCCESS/FAILURE packets to block golang.org/x/crypto/ssh read loop, causing deadlock and resource leak.

• highCVE-2026-39829

  CVE-2026-39829: golang.org/x/crypto/ssh RSA/DSA Key Size DoS

  golang.org/x/crypto/ssh < 0.52.0 parses RSA/DSA public keys without size limits, letting unauthenticated clients trigger minutes-long CPU exhaustion.

• criticalCVE-2026-39831

  CVE-2026-39831: golang.org/x/crypto/ssh FIDO/U2F User Presence Check Bypass

  golang.org/x/crypto/ssh skECDSA/skEd25519 Verify() never checked the FIDO UP flag, letting touch-free signatures authenticate on any server before v0.52.0.

• CRITICALCVE-2026-55166

  CVE-2026-55166: Lemur ACME SSRF + Creator IDOR leads to AWS IAM and PKI key compromise

  Lemur <1.9.2: SSO auto-provision + unfiltered acme_url SSRF hits EC2 IMDS; creator-equality IDOR leaks private keys after ownership transfer. CVSS 9.9.