How severe is CVE-2025-47913?

CVE-2025-47913 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2025-47913 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-47913?

CVE-2025-47913 affects Go Ssh. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-47913?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-47913 have an EU (EUVD) identifier?

Yes. CVE-2025-47913 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-177185.

When was CVE-2025-47913 published?

CVE-2025-47913 was published on 2025-11-13 and last updated on 2026-06-17.

CVE-2025-47913

CVE-2025-47913 is a high-severity vulnerability in Go Ssh with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-617.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-177185
Weakness: CWE-617
Affected product: Go Ssh
Published: 2025-11-13
Last modified: 2026-06-17

Description

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Frequently asked questions

What is CVE-2025-47913?: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
How severe is CVE-2025-47913?: CVE-2025-47913 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2025-47913 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-47913?: CVE-2025-47913 affects Go Ssh. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-47913?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-47913 have an EU (EUVD) identifier?: Yes. CVE-2025-47913 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-177185.
When was CVE-2025-47913 published?: CVE-2025-47913 was published on 2025-11-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:go:ssh:*:*:*:*:*:go:*:*

More vulnerabilities in Go Ssh

CVE-2025-22869 — High (CVSS 7.5): SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which…

All CVEs affecting Go Ssh →

Other CWE-617 (Reachable Assertion) vulnerabilities

CVE-2020-3615 — Critical (CVSS 9.8): Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue…
CVE-2019-9795 — Critical (CVSS 9.8): A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by…
CVE-2026-31739 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The…
CVE-2020-12417 — High (CVSS 8.8): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in…
CVE-2020-6623 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
CVE-2020-6619 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.

Browse all CWE-617 (Reachable Assertion) vulnerabilities →