---
id: CVE-2020-29652
aliases:
  - GHSA-3vm4-22fp-5rfm
  - GO-2021-0227
title: golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
summary: golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: x
product: golang.org/x/crypto
ecosystem: go
affected:
  - golang.org/x/crypto < 0.0.0-20201216223049-8b5274cf687f
patched:
  - golang.org/x/crypto 0.0.0-20201216223049-8b5274cf687f
published: '2022-05-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:29.811762044Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3vm4-22fp-5rfm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-29652'
  - url: 'https://go-review.googlesource.com/c/crypto/+/278852'
  - url: 'https://go.dev/cl/278852'
  - url: >-
      https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8
  - url: 'https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1'
  - url: >-
      https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
  - url: 'https://pkg.go.dev/vuln/GO-2021-0227'
tags:
  - osv
  - go
epss: 0.03267
epssPercentile: 0.87846
ingestedAt: '2026-09-12T03:13:01.750Z'
---

## Overview

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. An attacker can craft an authentication request message for the `gssapi-with-mic` method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.

## Affected packages

- `golang.org/x/crypto < 0.0.0-20201216223049-8b5274cf687f`

## Remediation

Upgrade to a patched release:

- `golang.org/x/crypto 0.0.0-20201216223049-8b5274cf687f`