A vulnerability in the Go x/crypto/ssh/agent package allows remote attackers to trigger a process panic and service termination by sending an unexpected SSH_AGENT_SUCCESS message.

This flaw is classified as improper handling of exceptional conditions (CWE-703), where the client panics when it receives an SSH_AGENT_SUCCESS message instead of the expected typed response. This vulnerability is remotely exploitable without authentication, as the attacker only needs to interact with the client process.

The exploitation of this vulnerability results in the immediate termination of the affected SSH client process, leading to a denial of service for any applications relying on this library. Given the CVSS score of 7.5, the high availability impact poses a significant risk to automated infrastructure, CI/CD pipelines, or remote management tools that depend on SSH connectivity.

Immediate Action: Update the golang.org/x/crypto/ssh/agent package to version 0.43.0 or later to incorporate the necessary fix.

Proactive Monitoring: Monitor application logs for unexpected process crashes or repeated panic traces occurring within the SSH agent component.

Compensating Controls: Ensure that SSH agents are running in isolated environments with restricted network access to minimize exposure to untrusted SSH servers that could trigger this condition.

Public Exploit Available: Unknown.

Organizations utilizing the Go x/crypto library for SSH agent functionality must prioritize upgrading to version 0.43.0 immediately. The ease of exploitation and the potential for widespread service disruption in automated environments necessitate a rapid response to eliminate this denial of service risk.