CVE-2025-47913
📋 TL;DR
This vulnerability affects SSH clients that panic and terminate when receiving SSH_AGENT_SUCCESS messages unexpectedly during authentication. It allows denial-of-service attacks against SSH client processes, affecting users of vulnerable Go-based SSH implementations.
💻 Affected Systems
- Go crypto/ssh package implementations
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical SSH client processes terminate during authentication, disrupting automated workflows, CI/CD pipelines, and remote administration capabilities.
Likely Case
SSH client sessions fail unexpectedly, causing temporary service disruption and requiring manual reconnection attempts.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated client failures with quick detection and recovery.
🎯 Exploit Status
Exploitation requires the client to connect to a malicious or compromised SSH server that sends unexpected SSH_AGENT_SUCCESS messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.24.1 or Go 1.23.8
Vendor Advisory: https://go.dev/cl/700295
Restart Required: Yes
Instructions:
1. Update Go to version 1.24.1 or 1.23.8. 2. Recompile affected applications. 3. Restart services using the updated binaries.
🔧 Temporary Workarounds
Disable SSH agent forwarding
allPrevents SSH_AGENT_SUCCESS messages by disabling agent forwarding
ssh -o ForwardAgent=no user@host
Use alternative SSH implementations
allTemporarily use OpenSSH or other non-Go SSH clients
🧯 If You Can't Patch
- Implement network segmentation to restrict SSH connections to trusted servers only
- Monitor for unexpected SSH client terminations and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check Go version with 'go version' and verify if below 1.24.1 or 1.23.8Check Version:
go versionVerify Fix Applied:
Confirm Go version is 1.24.1 or higher, or 1.23.8 or higher, and applications have been recompiled📡 Detection & Monitoring
Log Indicators:
- Unexpected SSH client termination
- Panic messages containing 'SSH_AGENT_SUCCESS'
- Authentication failures followed by process exit
Network Indicators:
- SSH connections that terminate immediately after authentication attempt
- Unusual SSH_AGENT_SUCCESS messages from servers
SIEM Query:
process.name:"ssh" AND event.action:"terminated" AND error.message:"panic"