VDB
RHSA-2026%3A13450
RHSA-2026%3A13450
PUBLISHED
CVSS 7.5 HIGH
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic("unreachable") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:6c24c11b2e11a96add54c80b270da6c707d17a72c08f30929a4b06a34b0b1ca0_arm64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:6c24c11b2e11a96add54c80b270da6c707d17a72c08f30929a4b06a34b0b1ca0_arm64, registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:6c24c11b2e11a96add54c80b270da6c707d17a72c08f30929a4b06a34b0b1ca0_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:54b9154093d57c55955248d44aebd83b8c53dcb3979f376f951de8839dbcdc17_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, *, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:54b9154093d57c55955248d44aebd83b8c53dcb3979f376f951de8839dbcdc17_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:29a189d07e39a657e9fca53bc37fb0a1c51947c4c1e46dc2ab396e9bc75c1933_amd64 as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:29a189d07e39a657e9fca53bc37fb0a1c51947c4c1e46dc2ab396e9bc75c1933_amd64, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:29a189d07e39a657e9fca53bc37fb0a1c51947c4c1e46dc2ab396e9bc75c1933_amd64, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:29a189d07e39a657e9fca53bc37fb0a1c51947c4c1e46dc2ab396e9bc75c1933_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:dd84f23d27b65d4dbf940df173426914263ce33e500ab7d1bfd954d32dacaed0_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:dd84f23d27b65d4dbf940df173426914263ce33e500ab7d1bfd954d32dacaed0_amd64, registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:dd84f23d27b65d4dbf940df173426914263ce33e500ab7d1bfd954d32dacaed0_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:b951f476c20cb0ee7510ad5a311d05c857b5b54a3cdb617af28492a9c051f05f_s390x as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:b951f476c20cb0ee7510ad5a311d05c857b5b54a3cdb617af28492a9c051f05f_s390x, *, registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:b951f476c20cb0ee7510ad5a311d05c857b5b54a3cdb617af28492a9c051f05f_s390x |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:100b2b4167b39e20247efa03a92ef814b9dd39acfb9e8ff8d69172e0c9f119f9_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:100b2b4167b39e20247efa03a92ef814b9dd39acfb9e8ff8d69172e0c9f119f9_amd64, registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:100b2b4167b39e20247efa03a92ef814b9dd39acfb9e8ff8d69172e0c9f119f9_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:0dac01ede6caebb44cdf779d89a41b55a729a451bc0ceaec2edab38d5108c9bb_s390x as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:0dac01ede6caebb44cdf779d89a41b55a729a451bc0ceaec2edab38d5108c9bb_s390x, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:0dac01ede6caebb44cdf779d89a41b55a729a451bc0ceaec2edab38d5108c9bb_s390x |
| Red Hat | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:71bf5638000451c225ea384499a2fe37765beaad2cdc87dd3d73a0b9f7c44dd3_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:71bf5638000451c225ea384499a2fe37765beaad2cdc87dd3d73a0b9f7c44dd3_amd64, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:71bf5638000451c225ea384499a2fe37765beaad2cdc87dd3d73a0b9f7c44dd3_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:1cc13e7c826632f27497c045a62cc3631da62b8db6f587fb8f6f32a481bd8ea5_s390x as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:1cc13e7c826632f27497c045a62cc3631da62b8db6f587fb8f6f32a481bd8ea5_s390x, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:f127aef9cdaa77a07ac63b560e0baac6ebbde08fb03941a7b9cf240a86de5319_arm64 as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:f127aef9cdaa77a07ac63b560e0baac6ebbde08fb03941a7b9cf240a86de5319_arm64, *, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:f127aef9cdaa77a07ac63b560e0baac6ebbde08fb03941a7b9cf240a86de5319_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:88d505c2c81da0c00916cf751bbe2ad4e9e551f17a4a3300bde1c4fd42a00385_amd64 as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:88d505c2c81da0c00916cf751bbe2ad4e9e551f17a4a3300bde1c4fd42a00385_amd64, registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:88d505c2c81da0c00916cf751bbe2ad4e9e551f17a4a3300bde1c4fd42a00385_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:0b3491873a663040e59cc06f0da29493ce159a00426bfcca0782edbd20713c82_arm64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:0b3491873a663040e59cc06f0da29493ce159a00426bfcca0782edbd20713c82_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:4a0b89da325e0a169ae168c5ded8aef3f26f315b369acf53f6f1193be3637d8d_arm64 as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:4a0b89da325e0a169ae168c5ded8aef3f26f315b369acf53f6f1193be3637d8d_arm64, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:4a0b89da325e0a169ae168c5ded8aef3f26f315b369acf53f6f1193be3637d8d_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:071d4baa372d8e9390f3c44d44e06bd7a1199190c4913ae72382195d1a566c7a_arm64 as a component of Red Hat Container Native Virtualization 4.19 | *, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:51a8f4f79f2ec4fb73f3eb2eb2b3e1ab92f0df7ffc0d23bfd1064aafde804d4d_arm64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:51a8f4f79f2ec4fb73f3eb2eb2b3e1ab92f0df7ffc0d23bfd1064aafde804d4d_arm64, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:51a8f4f79f2ec4fb73f3eb2eb2b3e1ab92f0df7ffc0d23bfd1064aafde804d4d_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:36a071d79ac8020d825bdf3fc850d84fd89f182dcd83969c1202b67f519bdd44_s390x as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:36a071d79ac8020d825bdf3fc850d84fd89f182dcd83969c1202b67f519bdd44_s390x, *, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:36a071d79ac8020d825bdf3fc850d84fd89f182dcd83969c1202b67f519bdd44_s390x |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:c77064475c547f0d0e711824af1962fe58a2cbba4cdcaa4e201bb9f814b60158_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:c77064475c547f0d0e711824af1962fe58a2cbba4cdcaa4e201bb9f814b60158_amd64, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:c77064475c547f0d0e711824af1962fe58a2cbba4cdcaa4e201bb9f814b60158_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:1c75d95a2823fbe1d375c94d747834c6649859f4addff478f17313760a34cff2_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:1c75d95a2823fbe1d375c94d747834c6649859f4addff478f17313760a34cff2_amd64, registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:1c75d95a2823fbe1d375c94d747834c6649859f4addff478f17313760a34cff2_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:fbb023d5df067dbe85e52f7b32859392db47429cd1ec778be18a8e992b9db0d2_amd64 as a component of Red Hat Container Native Virtualization 4.19 | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:fbb023d5df067dbe85e52f7b32859392db47429cd1ec778be18a8e992b9db0d2_amd64, *, registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:fbb023d5df067dbe85e52f7b32859392db47429cd1ec778be18a8e992b9db0d2_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:159396fb6f95355ec72fe9413b5620a93e2cbcf3067edd009c7bbe12816e914c_amd64 as a component of Red Hat Container Native Virtualization 4.19 | *, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:159396fb6f95355ec72fe9413b5620a93e2cbcf3067edd009c7bbe12816e914c_amd64, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:159396fb6f95355ec72fe9413b5620a93e2cbcf3067edd009c7bbe12816e914c_amd64 |
…and 19 more
Timeline
- May 4, 2026 CVE Published
- May 4, 2026 Distribution Patch
- May 4, 2026 Distribution Patch
- May 4, 2026 Security Advisory
- May 4, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:13450 advisory
- https://access.redhat.com/security/cve/CVE-2025-47913 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13450.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2414943 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47913 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47913 advisory
- https://github.com/advisories/GHSA-hcg3-q754-cr77 advisory
- https://go.dev/cl/700295 advisory
- https://go.dev/issue/75178 advisory
- https://pkg.go.dev/vuln/GO-2025-4116 advisory