An incorrectly placed cast from bytes to int in the AES‑GCM packet decoder of golang.org/x/crypto/ssh causes an arithmetic underflow that results in a server‑side panic. The flaw does not directly expose data or grant privileges, but it can crash the service, leading to an availability loss. The vulnerability is rooted in improper type conversion and integer underflow, categorised as CWE‑704 and CWE‑680.

The affected component is golang.org/x/crypto/ssh from the Golang crypto library. No specific version range is supplied in the advisory, so the issue likely affects all releases before the fix referenced in the issue tracker.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so no public evidence of exploitation exists at this time. Nevertheless, a remote attacker who can send data to a vulnerable SSH server could craft malformed AES‑GCM packets that trigger the underflow and panic. The attack can be performed without authentication, depending on the server’s readiness to process inbound packets.