CVE-2025-47914: 
脆弱性の分析と軽減

CVE-2025-47914 is a security vulnerability affecting the golang.org/x/crypto/ssh/agent package. The vulnerability was discovered by Jakub Ciolek and publicly disclosed on November 19, 2025. The issue affects SSH Agent servers that fail to validate message sizes when processing new identity requests (Golang Announce).

The vulnerability exists in the SSH Agent server implementation where message size validation is not performed during the processing of new identity requests. This oversight can lead to an out-of-bounds read condition when handling malformed messages. The issue has been fixed in version v0.45.0 of golang.org/x/crypto (Go Packages).

When exploited, this vulnerability can cause the affected program to panic due to out-of-bounds read operations when processing malformed messages. This could potentially lead to service disruption in applications using the vulnerable SSH Agent server implementation (Golang Announce).

Users should upgrade to golang.org/x/crypto version v0.45.0 or later to address this vulnerability. This version includes the necessary fixes to properly validate message sizes during new identity request processing (Golang Announce).