A malformed NTLM challenge can trigger a slice out of bounds panic in the go-ntlmssp package, causing any Go process that uses the ntlmssp.Negotiator HTTP transport to terminate unexpectedly. This flaw results in a denial‑of‑service condition rather than data exposure or remote code execution. The weakness stems from integer bounds checking failures as indicated by CWE‑190.

The vulnerability affects the Azure go‑ntlmssp library used for NTLM/Negotiate authentication within Go applications. Versions prior to 0.1.1 are impacted; upgrading to 0.1.1 resolves the issue.

The CVSS score of 5.3 classifies the risk as moderate, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no documented active exploitation. Attackers would need to deliver a crafted NTLM challenge to a vulnerable service employing this library, which is feasible if NTLM authentication is enabled.