CVE-2026-39835

Description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

References

• https://go.dev/cl/781660
• https://go.dev/issue/79563
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5015