The vulnerability arises when an SSH server uses the CertChecker callback without configuring either the IsUserAuthority or IsHostAuthority functions. Based on the description, it is inferred that a client presenting an X.509 certificate can trigger a nil‑pointer dereference, causing the Go crypto SSH server to panic, stopping the server process and resulting in a denial of service. The crash does not expose stored data but disrupts availability.

The flaw affects any deployment of golang.org/x/crypto/ssh that employs CertChecker as the public key callback while leaving the authority callbacks unset. No specific version range is documented in the vulnerability record, so any version before the fix should be considered vulnerable.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of < 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating limited exploitation evidence to date. Based on the description, it is inferred that an attacker who can control the client certificate can connect to the SSH server, supply any certificate, and the server will panic, leading to a denial of service. This is a functional and impactful attack that exploits the nil‑pointer dereference weakness.