VDB
GHSA-f6x5-jh6r-wrfv
GHSA-f6x5-jh6r-wrfv
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Record from GitHub Advisory Database · Published November 19, 2025
golang.org/x/crypto is fixed in 0.45.0 (Go Modules)
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| golang.org/x/crypto | Go Modules | 0.45.0 |
| crossplane-provider-aws-iam | Wolfi | 2.2.0-r1 |
| kubernetes-csi-external-attacher-fips | Chainguard | 4.10.0-r2 |
| goreleaser | Wolfi | 2.12.7-r1 |
| spire-server | Chainguard | 1.13.3-r1 |
| etcd-fips-3.4 | Chainguard | 3.4.45-r0 |
| gitlab-pages-18.5 | Chainguard | 18.5.2-r1 |
| gitlab-rails-ce-18.8 | Chainguard | 18.8.4-r1 |
| gitaly-18.5 | Wolfi | 18.5.2-r1 |
| gitaly-18.4 | Wolfi | 18.4.4-r1 |
| telegraf-1.34 | Chainguard | 1.34.4-r8 |
| etcd-fips-3.6 | Chainguard | 3.6.6-r1 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | atlas-1.0 | * |
| wolfi | crossplane-provider-aws-iam | 0 |
| chainguard | kubernetes-csi-external-attacher-fips | 0 |
| wolfi | goreleaser | 0 |
| chainguard | litestream | * |
| chainguard | spire-server | 0 |
| chainguard | etcd-fips-3.4 | 0 |
| chainguard | gitlab-pages-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| wolfi | gitaly-18.5 | 0 |
| chainguard | volcano-fips | * |
| wolfi | gitaly-18.4 | 0 |
| chainguard | telegraf-1.34 | 0 |
| chainguard | etcd-fips-3.6 | 0 |
| wolfi | rancher-telemetry | 0 |
| wolfi | minio-operator | 0 |
| chainguard | terraform | 0 |
| wolfi | gitlab-runner-18.5 | * |
| wolfi | knative-serving-1.17 | * |
| chainguard | sftpgo-plugin-eventstore | 0 |
…and 1801 more
Timeline
- Nov 19, 2025 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-f6x5-jh6r-wrfv
vulnetix vdb fixes GHSA-f6x5-jh6r-wrfvOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-f6x5-jh6r-wrfv/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart