VDB
RHSA-2026%3A13431
RHSA-2026%3A13431
PUBLISHED
CVSS 7.5 HIGH
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic("unreachable") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:a2211e0bd514790fe9749614fbbdb7f24c78553931d26cacc1b09a249351fc73_arm64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:a2211e0bd514790fe9749614fbbdb7f24c78553931d26cacc1b09a249351fc73_arm64, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:0335dce2f5ed915ee7e87af95397faace9bd13b998e6b2f3f3c2731c679cfc94_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:0335dce2f5ed915ee7e87af95397faace9bd13b998e6b2f3f3c2731c679cfc94_arm64, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:0335dce2f5ed915ee7e87af95397faace9bd13b998e6b2f3f3c2731c679cfc94_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:5bea70e2ac09d488c70c57bb1f67e25df690d011c8fccedc8c2f71c5ba85ab8c_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:5bea70e2ac09d488c70c57bb1f67e25df690d011c8fccedc8c2f71c5ba85ab8c_arm64, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:5bea70e2ac09d488c70c57bb1f67e25df690d011c8fccedc8c2f71c5ba85ab8c_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:7e6938a25df9a72abf67b484ea12618ddb4146a99f57f18abb289e8bb3fc3f3a_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b32654a44ecd9f6e8907f3f1c61672b8d8c711309101a783f5163969fd134b1d_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b32654a44ecd9f6e8907f3f1c61672b8d8c711309101a783f5163969fd134b1d_arm64, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b32654a44ecd9f6e8907f3f1c61672b8d8c711309101a783f5163969fd134b1d_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:2457d7067501cc5d6c9e71462ed1c7a84b57b3b2a0085977fa5a6c162453c6cd_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:2457d7067501cc5d6c9e71462ed1c7a84b57b3b2a0085977fa5a6c162453c6cd_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:923dfbda8d194e4b8b99457b44a6d614e5884f1e5e8a011274c64c928a39c2b5_arm64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:923dfbda8d194e4b8b99457b44a6d614e5884f1e5e8a011274c64c928a39c2b5_arm64, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:4b6dc49d1dd9bb43401f136c6220430851029a5e9568b8f94011edb00d8727af_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:4b6dc49d1dd9bb43401f136c6220430851029a5e9568b8f94011edb00d8727af_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:4e7bc28d353ef5e80d73c9f1a9a39460407572545d43ee9edd9d7f59238547bb_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:4e7bc28d353ef5e80d73c9f1a9a39460407572545d43ee9edd9d7f59238547bb_amd64, registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:4e7bc28d353ef5e80d73c9f1a9a39460407572545d43ee9edd9d7f59238547bb_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:6693bd574b2887c1969c85780d16ff49f6bd7c9f61d63ef872977d87d9f436ac_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:6693bd574b2887c1969c85780d16ff49f6bd7c9f61d63ef872977d87d9f436ac_arm64, registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:6693bd574b2887c1969c85780d16ff49f6bd7c9f61d63ef872977d87d9f436ac_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:03f4cae27e192fbaa841b75c94144de53dda1a42f2f3afe1ec8dae7360b62cbd_amd64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:03f4cae27e192fbaa841b75c94144de53dda1a42f2f3afe1ec8dae7360b62cbd_amd64, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:affd591a7a0bc48e5e26cf15f520334d8e479540bd9d041b879972ebb67ebafe_arm64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:affd591a7a0bc48e5e26cf15f520334d8e479540bd9d041b879972ebb67ebafe_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:455bbde77709328fb24c868bbd1787bd8ff7416b8b21ab193bfd648e53af44dc_arm64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:455bbde77709328fb24c868bbd1787bd8ff7416b8b21ab193bfd648e53af44dc_arm64, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:39a35427e40e1cc7ac2a316d49b7ecc834664e348f407f43f2b1f1a623e9dec5_amd64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:39a35427e40e1cc7ac2a316d49b7ecc834664e348f407f43f2b1f1a623e9dec5_amd64, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:e8afcc403a1f8a9b3fef8de1f35cf48e5f514ccca54127d224727ab8237b2a8a_arm64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:e8afcc403a1f8a9b3fef8de1f35cf48e5f514ccca54127d224727ab8237b2a8a_arm64, *, registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:e8afcc403a1f8a9b3fef8de1f35cf48e5f514ccca54127d224727ab8237b2a8a_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:2e5bcaa78176f3dc0ceaca67e137e93a0aaa87a3549e3e2a75a145e9dda061e5_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:2e5bcaa78176f3dc0ceaca67e137e93a0aaa87a3549e3e2a75a145e9dda061e5_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:3886dde6df92ed675a8ae925c2fca55689427e2b0d98370dd3f4c64affd4976c_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:3886dde6df92ed675a8ae925c2fca55689427e2b0d98370dd3f4c64affd4976c_amd64, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:3886dde6df92ed675a8ae925c2fca55689427e2b0d98370dd3f4c64affd4976c_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:d3307886b24877a4931cda0d29ed64caab03f99a4eca13de057bac217dcdf2e9_amd64 as a component of Red Hat Container Native Virtualization 4.14 | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:d3307886b24877a4931cda0d29ed64caab03f99a4eca13de057bac217dcdf2e9_amd64, registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:d3307886b24877a4931cda0d29ed64caab03f99a4eca13de057bac217dcdf2e9_amd64, * |
| golang.org | x/crypto/ssh/agent | |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:2a14da43018bf6e9aae844bbb91f7d354cb65905b46fc4c6c43981a11164a5ec_amd64 as a component of Red Hat Container Native Virtualization 4.14 | *, *, * |
…and 1 more
Timeline
- May 4, 2026 CVE Published
- May 5, 2026 Distribution Patch
- May 5, 2026 Distribution Patch
- May 5, 2026 Security Advisory
- May 5, 2026 Security Advisory
- Aug 2, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:13431 advisory
- https://access.redhat.com/security/cve/CVE-2025-47913 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13431.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2414943 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47913 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47913 advisory
- https://github.com/advisories/GHSA-hcg3-q754-cr77 advisory
- https://go.dev/cl/700295 advisory
- https://go.dev/issue/75178 advisory
- https://pkg.go.dev/vuln/GO-2025-4116 advisory