CVE-2025-47914
golang-go.crypto: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the pro...
CVE-2025-47914 is fixed in 27 products on 1 platform, first by DEBIAN-CVE-2025-47914, released November 19, 2025. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.3
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0055
46th percentile
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| amazon-cloudwatch-agent · amzn 2023 | 1.300062.1-1.amzn2023 | ALAS2023-2025-1358 | Jan 7, 2026 |
| apptainer · opensuse-leap 15.6 | 1.4.5-150600.4.12.1 | SUSE-SU-2026:0439-1 | Feb 11, 2026 |
| apptainer · sles 15.7 | 1.4.5-150600.4.12.1 | SUSE-SU-2026:0439-1 | Feb 11, 2026 |
| buildah · opensuse-leap 15.6 | 1.35.5-150500.3.53.1 | SUSE-SU-2026:0014-1 | Jan 5, 2026 |
| buildah · opensuse-leap 16.0 | 1.39.5-160000.1.1 | OPENSUSE-SU-2026:20080-1 | Jan 22, 2026 |
| buildah · sles 15.6 | 1.35.5-150500.3.62.1 | SUSE-SU-2026:2733-1 | Jul 2, 2026 |
| buildah · sles 15.7 | 1.35.5-150500.3.62.1 | SUSE-SU-2026:2733-1 | Jul 2, 2026 |
| buildah · sles 16.0 | 1.39.5-160000.1.1 | SUSE-SU-2026:20123-1 | Jan 22, 2026 |
| cheat · opensuse-leap 16.0 | 4.4.2-bp160.2.1 | OPENSUSE-SU-2025:20177-1 | Dec 18, 2025 |
| containerized-data-importer · sles 15.7 | 1.64.0-150700.9.11.1 | SUSE-SU-2026:2493-1 | Jun 22, 2026 |
| containerized-data-importer1.65 · opensuse-leap 16.0 | 1.65.0-160000.3.1 | OPENSUSE-SU-2026:21824-1 | Sep 9, 2026 |
| docker · amzn 2023 | 25.0.14-1.amzn2023.0.1 | ALAS2023-2025-1340 | Jan 7, 2026 |
| docker-compose · opensuse-leap 16.0 | 2.33.1-160000.4.1 | OPENSUSE-SU-2026:20438-1 | Mar 27, 2026 |
| docker-compose · sles 16.0 | 2.33.1-160000.4.1 | SUSE-SU-2026:20976-1 | Mar 27, 2026 |
| docker-debuginfo · amzn 2023 | 25.0.14-1.amzn2023.0.1 | ALAS2023-2025-1340 | Jan 7, 2026 |
| docker-debugsource · amzn 2023 | 25.0.14-1.amzn2023.0.1 | ALAS2023-2025-1340 | Jan 7, 2026 |
| elemental-register · opensuse-leap 16.0 | 1.8.1-160000.1.1 | OPENSUSE-SU-2026:20132-1 | Jan 29, 2026 |
| elemental-toolkit · opensuse-leap 16.0 | 2.3.2-160000.1.1 | OPENSUSE-SU-2026:20132-1 | Jan 29, 2026 |
| git-bug · opensuse-leap 16.0 | 0.10.1-bp160.1.1 | OPENSUSE-SU-2025:20143-1 | Dec 4, 2025 |
| golang-go.crypto · Debian 14 | 1:0.45.0-1 | DEBIAN-CVE-2025-47914 | Nov 19, 2025 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | OPENSUSE-SU-2026:21483-1 | Jul 30, 2026 |
| keepassxc · Fedora 43 | 2.8.0-2.fc43 | FEDORA-2026-4D8F0CDDEF | Nov 7, 2026 |
| keepassxc-debuginfo · Fedora 43 | 2.8.0-2.fc43 | FEDORA-2026-4D8F0CDDEF | Nov 7, 2026 |
| keepassxc-debugsource · Fedora 43 | 2.8.0-2.fc43 | FEDORA-2026-4D8F0CDDEF | Nov 7, 2026 |
| kubevirt · sles 15.7 | 1.7.4-150700.3.24.2 | SUSE-SU-2026:2400-1 | Jun 15, 2026 |
| kubevirt-1.6 · sles 15.7 | 1.6.6-150700.15.17.1 | SUSE-SU-2026:3630-1 | Aug 17, 2026 |
| nerdctl · amzn 2023 | 2.2.1-1.amzn2023.0.1 | ALAS2023-2026-1400 | Feb 5, 2026 |
| podman · opensuse-leap 15.6 | 4.9.5-150500.3.62.2 | SUSE-SU-2026:0067-1 | Jan 8, 2026 |
| podman · opensuse-leap 16.0 | 5.4.2-160000.5.1 | OPENSUSE-SU-2026:21244-1 | Jul 6, 2026 |
| podman · sles 15.7 | 4.9.5-150500.3.62.2 | SUSE-SU-2026:0067-1 | Jan 8, 2026 |
| podman · sles 16.0 | 5.4.2-160000.4.1 | SUSE-SU-2026:20626-1 | Mar 3, 2026 |
| runfinch-finch · amzn 2023 | 1.10.0-1.amzn2023.0.6 | ALAS2023-2025-1336 | Jan 7, 2026 |
| squashfuse · opensuse-leap 15.6 | 0.5.0-150600.3.2.1 | SUSE-SU-2026:0439-1 | Feb 11, 2026 |
| squashfuse · sles 15.7 | 0.5.0-150600.3.2.1 | SUSE-SU-2026:0439-1 | Feb 11, 2026 |
| tailscale · Fedora 43 | 1.102.5-1.fc43 | FEDORA-2026-0451D4F86A | Nov 7, 2026 |
| tailscale-debuginfo · Fedora 43 | 1.102.5-1.fc43 | FEDORA-2026-0451D4F86A | Nov 7, 2026 |
| tailscale-debugsource · Fedora 43 | 1.102.5-1.fc43 | FEDORA-2026-0451D4F86A | Nov 7, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.