CVE-2026-32952: 
Terraform Community vulnerability analysis and mitigation

CVE-2026-32952 is a denial-of-service vulnerability in go-ntlmssp, a Go package (maintained under the Azure GitHub organization) that provides NTLM/Negotiate authentication over HTTP. A malicious NTLM challenge message can trigger a slice out-of-bounds panic, crashing any Go process that uses ntlmssp.Negotiator as an HTTP transport. All versions prior to v0.1.1 are affected. The advisory was published on April 23, 2026, with NVD publication on April 24, 2026. The CVSS v3.1 base score is 5.3 (Medium) per the GitHub Advisory Database, though Feedly's NVD-sourced data also reports a score of 7.5 (High) (Github Advisory, Azure Advisory).

The root cause is classified as CWE-190 (Integer Overflow or Wraparound), where a calculation on attacker-controlled data in a malformed NTLM challenge message produces an incorrect integer value, leading to an out-of-bounds slice access and a Go runtime panic. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an unauthenticated remote attacker simply needs to serve a crafted NTLM challenge response to a client using the vulnerable ntlmssp.Negotiator transport. The precondition is that the target application must be acting as an HTTP client performing NTLM authentication against an attacker-controlled or compromised server (Github Advisory, Azure Advisory).

Successful exploitation results in a Go runtime panic that crashes the entire process using ntlmssp.Negotiator as an HTTP transport, causing a complete loss of availability for the affected application. There is no impact on confidentiality or data integrity — the vulnerability is purely a denial-of-service condition. Downstream projects that embed go-ntlmssp (such as rclone and Portainer, which have issued updated releases referencing this CVE) are also affected until they update their dependency (Github Advisory, rclone Changelog, Portainer Release).

1. Identify target: Locate a Go application that uses github.com/Azure/go-ntlmssp (version < 0.1.1) as an HTTP transport for NTLM authentication — examples include rclone or Portainer instances configured to authenticate against SMB/HTTP endpoints.
2. Set up a malicious server: Deploy an HTTP or SMB server that responds to NTLM Negotiate requests with a crafted NTLM challenge message containing malformed length or offset fields designed to trigger an integer overflow in the slice bounds calculation.
3. Trigger authentication: Cause the target Go application to initiate an HTTP request to the attacker-controlled server (e.g., via a misconfigured mount point, redirect, or SSRF), prompting it to begin NTLM negotiation.
4. Deliver malformed challenge: Respond to the client's NTLM Negotiate message with the crafted challenge payload; the vulnerable parsing code performs an integer overflow, resulting in an out-of-bounds slice access.
5. Achieve denial of service: The Go runtime detects the out-of-bounds access and triggers a panic, crashing the entire Go process and causing a denial of service (Azure Advisory).

• Logs: Go application crash logs or stderr output containing panic: runtime error: index out of range or slice bounds out of range originating from the go-ntlmssp package stack trace.
• Process: Unexpected termination of Go-based services (e.g., rclone, Portainer) that use NTLM authentication, particularly following HTTP requests to external or newly configured endpoints.
• Network: Repeated NTLM authentication attempts from the application to an unusual or external server, followed by abrupt connection termination; malformed NTLM Type 2 (challenge) messages in network captures with anomalous field lengths or offsets.

The fix is available in github.com/Azure/go-ntlmssp version v0.1.1, released April 23, 2026. Developers should update their Go module dependency to v0.1.1 or later by running go get github.com/Azure/go-ntlmssp@v0.1.1 and rebuilding affected applications. Downstream projects embedding this library (e.g., rclone, Portainer) should upgrade to versions that include the patched dependency. No configuration-based workaround is available; upgrading is the only remediation (Azure Advisory, v0.1.1 Release).

The vulnerability was disclosed by maintainer qmuntal via a GitHub Security Advisory on April 23, 2026, with a same-day patch release. OpenSUSE issued security announcements covering the vulnerability for affected packages in their distribution. The rclone project noted the fix in their changelog, and Portainer addressed it across multiple release versions (2.33.8, 2.39.2, 2.42.0), indicating broad downstream awareness and prompt remediation across the Go ecosystem (OpenSUSE Advisory, rclone Changelog, Portainer Release).