Microsoft Go-ntlmssp vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Microsoft Go-ntlmssp: 1 record(s), with affected versions and fixes.
cpe:2.3:a:microsoft:go-ntlmssp

CVE-2026-32952 High · 7.5 CWE-190 Apr 24, 2026

go-ntlmssp NTLM challenges can panic on malformed payloads

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.