CVE-2026-32952 | THREATINT

Description

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.

PUBLISHED Reserved 2026-03-17 | Published 2026-04-24 | Updated 2026-04-24 | Assigner GitHub_M

MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem types

CWE-190: Integer Overflow or Wraparound

Product status

< 0.1.1

affected

References

github.com/...tlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj

github.com/Azure/go-ntlmssp/releases/tag/v0.1.1

cve.org (CVE-2026-32952)

nvd.nist.gov (CVE-2026-32952)

Download JSON