Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-39832

  CVE-2026-39832: golang.org/x/crypto/ssh/agent SSH Key Forwarding Constraint Bypass

  golang.org/x/crypto/ssh/agent < 0.52.0 silently drops restrict-destination constraint extensions when forwarding SSH keys to a remote agent, enabling lateral movement.

• highCVE-2026-46597

  CVE-2026-46597: golang.org/x/crypto/ssh AES-GCM Packet Decoder Integer Underflow DoS

  golang.org/x/crypto/ssh < 0.52.0: a byte-to-uint32 arithmetic underflow in gcmCipher.readCipherPacket lets any client panic an SSH server.