The vulnerability arises when an SSH server uses the CertChecker callback without configuring either the IsUserAuthority or IsHostAuthority functions. A client that presents an X.509 certificate can trigger a nil‑pointer dereference, causing the Go crypto SSH server to panic. This panic stops the server process, making the service unavailable to legitimate users; it does not expose stored data, but it disrupts availability and can facilitate a denial‑of‑service attack.

The flaw affects any deployment of golang.org/x/crypto/ssh that employs CertChecker as the public key callback while leaving the authority callbacks unset. No specific version range is documented in the vulnerability record, so any version before the fix should be considered vulnerable.

There is no EPSS score reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or at least unnamed exploitation evidence to date. However, the flaw is exploitable by an attacker who can control the client certificate presented to the server. The attack path is straightforward: connect to the SSH server, supply any certificate, and the server will panic, leading to a denial of service. The lack of mitigations on the server side and the path of execution via the public key callback mean the vulnerability is both actionable and potentially impactful for services relying on this library.