Golang Crypto/SSH Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Golang SSH package, specifically in versions prior to 0.35.0. This issue affects SSH servers that implement file transfer protocols. The vulnerability arises when clients complete the key exchange slowly or not at all, causing pending content to be read into memory but never transmitted. This can lead to excessive memory usage and potential service disruption.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, leading to increased memory usage and potential service disruption.

Remediation

NetApp products affected by this vulnerability should be updated to a version that includes the patched Golang Crypto/SSH package. Instructions for updating can be found in the NetApp advisory NTAP-20250411-0010.