VDB
RHSA-2026%3A13630
RHSA-2026%3A13630
PUBLISHED
CVSS 7.5 HIGH
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic("unreachable") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:b36593c8d713be8ac5fa0d1d3f3f7dc63ba3fef7964e632f2e82bb1c1fa9c5c0_amd64 as a component of Red Hat Container Native Virtualization 4.2 | *, *, registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:b36593c8d713be8ac5fa0d1d3f3f7dc63ba3fef7964e632f2e82bb1c1fa9c5c0_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:265434694ecd1aad14247415a4fddcd06d83aa7610a93988cb03d1ca1f93d313_s390x as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:265434694ecd1aad14247415a4fddcd06d83aa7610a93988cb03d1ca1f93d313_s390x, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:265434694ecd1aad14247415a4fddcd06d83aa7610a93988cb03d1ca1f93d313_s390x |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b603b10c1f3c18d0a44ddc0a81b81eda6a3431733fe8b7afad5adb412b7ae041_arm64 as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b603b10c1f3c18d0a44ddc0a81b81eda6a3431733fe8b7afad5adb412b7ae041_arm64, registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b603b10c1f3c18d0a44ddc0a81b81eda6a3431733fe8b7afad5adb412b7ae041_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:71604850d2cd41db93c0d3d8eed15ad5d586883bd1d58db46bbb1e1739692b92_s390x as a component of Red Hat Container Native Virtualization 4.2 | *, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:4eef30fed2d0c76621dc5ddeadad9662041dc5f1eb84a4a639223f98775f86e6_amd64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:4eef30fed2d0c76621dc5ddeadad9662041dc5f1eb84a4a639223f98775f86e6_amd64, *, registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:4eef30fed2d0c76621dc5ddeadad9662041dc5f1eb84a4a639223f98775f86e6_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:9582c0c9bdcce1f161a6f4ae66a0110b0fec5e3d93889883d88583e12b5c8c6e_s390x as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:9582c0c9bdcce1f161a6f4ae66a0110b0fec5e3d93889883d88583e12b5c8c6e_s390x, *, * |
| Red Hat | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a1e79718fe80f771368c06a708c9525d2a54d8c34b7efa2160ef5397f16159aa_arm64 as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a1e79718fe80f771368c06a708c9525d2a54d8c34b7efa2160ef5397f16159aa_arm64, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a1e79718fe80f771368c06a708c9525d2a54d8c34b7efa2160ef5397f16159aa_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:5f41a77d32f0dcf0a57f69670a66644f386629ee1286a6400d293c6393c9221c_s390x as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:5f41a77d32f0dcf0a57f69670a66644f386629ee1286a6400d293c6393c9221c_s390x, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:cadfaeb9cd72aec112fe065427e8e1b6eeff2c6210fcf681b0d69aa6d2ea4ec0_amd64 as a component of Red Hat Container Native Virtualization 4.2 | *, *, registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:cadfaeb9cd72aec112fe065427e8e1b6eeff2c6210fcf681b0d69aa6d2ea4ec0_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:98d088f850bdbf34fe290e61130745006028484b42750e2f270c391f70ed0748_amd64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:98d088f850bdbf34fe290e61130745006028484b42750e2f270c391f70ed0748_amd64, registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:98d088f850bdbf34fe290e61130745006028484b42750e2f270c391f70ed0748_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:5a987ffaa90ad411406126c176bac2b637cd497830a0b6435e7f38d8750f3741_amd64 as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:5a987ffaa90ad411406126c176bac2b637cd497830a0b6435e7f38d8750f3741_amd64, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:5a987ffaa90ad411406126c176bac2b637cd497830a0b6435e7f38d8750f3741_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:436d7cad73f5661c2b9b39e229849f46097e9b09c4d4f8cbe7ab7b22ce999bb7_arm64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:436d7cad73f5661c2b9b39e229849f46097e9b09c4d4f8cbe7ab7b22ce999bb7_arm64, *, registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:436d7cad73f5661c2b9b39e229849f46097e9b09c4d4f8cbe7ab7b22ce999bb7_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:6a0b69ef61cc0651a5db276a26a3025c65584ebdc8a719d18400555c4e9d9f6a_arm64 as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:6a0b69ef61cc0651a5db276a26a3025c65584ebdc8a719d18400555c4e9d9f6a_arm64, registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:6a0b69ef61cc0651a5db276a26a3025c65584ebdc8a719d18400555c4e9d9f6a_arm64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:b4b0c1ce4543c4f7eab8f635b51b68e32348bbf641941d041d48f62ba1cabc10_arm64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:b4b0c1ce4543c4f7eab8f635b51b68e32348bbf641941d041d48f62ba1cabc10_arm64, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:b4b0c1ce4543c4f7eab8f635b51b68e32348bbf641941d041d48f62ba1cabc10_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:780866347073738c662e0192df99cfdca8fbbc63f602179a057811f881925c7f_s390x as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:780866347073738c662e0192df99cfdca8fbbc63f602179a057811f881925c7f_s390x, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:780866347073738c662e0192df99cfdca8fbbc63f602179a057811f881925c7f_s390x, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:fa050da8cd5cf5a3776517d2e5d56198df3489aaf183bf2c8433a4a0faa2a4ff_amd64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:fa050da8cd5cf5a3776517d2e5d56198df3489aaf183bf2c8433a4a0faa2a4ff_amd64, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:fa050da8cd5cf5a3776517d2e5d56198df3489aaf183bf2c8433a4a0faa2a4ff_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:99e3afbe451756b589b87f19411bbf2af94472a82a4634df335889813693f01f_amd64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:99e3afbe451756b589b87f19411bbf2af94472a82a4634df335889813693f01f_amd64, *, registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:99e3afbe451756b589b87f19411bbf2af94472a82a4634df335889813693f01f_amd64 |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:d8e0c79e39bd18038eb19c39c5369e16ec7096e8f87a8a986895e298b466eacc_amd64 as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:d8e0c79e39bd18038eb19c39c5369e16ec7096e8f87a8a986895e298b466eacc_amd64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:d5a4fbbfaec296e82dea233159f65cc45eda5551d6dbb94acf019948c1df061c_arm64 as a component of Red Hat Container Native Virtualization 4.2 | registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:d5a4fbbfaec296e82dea233159f65cc45eda5551d6dbb94acf019948c1df061c_arm64, registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:d5a4fbbfaec296e82dea233159f65cc45eda5551d6dbb94acf019948c1df061c_arm64, * |
| Red Hat | registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:029881b5f87d07cbc3929dde4096cb368b8b3779bf378fedcfb8a5ac1a2cf90c_s390x as a component of Red Hat Container Native Virtualization 4.2 | *, registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:029881b5f87d07cbc3929dde4096cb368b8b3779bf378fedcfb8a5ac1a2cf90c_s390x, * |
…and 22 more
Timeline
- May 5, 2026 CVE Published
- May 5, 2026 Distribution Patch
- May 5, 2026 Distribution Patch
- May 5, 2026 Security Advisory
- May 5, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:13630 advisory
- https://access.redhat.com/security/cve/CVE-2025-47913 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13630.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2414943 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47913 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47913 advisory
- https://github.com/advisories/GHSA-hcg3-q754-cr77 advisory
- https://go.dev/cl/700295 advisory
- https://go.dev/issue/75178 advisory
- https://pkg.go.dev/vuln/GO-2025-4116 advisory