CVE-2025-47914

Published Nov 19, 2025

Last updated 7 months ago

CVSS medium 5.3
Splunk

Overview

Description
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Source
security@golang.org
NVD status
Analyzed
Products
crypto

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.3
Impact score
1.4
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-125

Social media

Hype score
Not currently trending

  1. SUSE released fixes for kubevirt 1.6 and 1.7 addressing CVE-2025-47911, CVE-2025-47913 and CVE-2025-47914 privilege escalation and denial-of-service bugs in embedded Go components, Linuxsecurity reported. https://t.co/6QY6iezav6

    @threatcluster

    16 Jun 2026

    55 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Critical Podman security patch: CVE-2025-47914 (moderate severity) affects ssh-agent in #SUSE distributions. Read more: 👉 https://t.co/LFlrCNDyjO #Security https://t.co/xUJ6RwPb8d

    @Cezar_H_Linux

    15 Jan 2026

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 Security Update: CVE-2025-47914 affects Podman on #openSUSE Leap 15.4 & SUSE Linux Enterprise Micro. CVSS:4.0 score: 6.9. Patch now to prevent SSH-agent panic from out-of-bounds read. Read more: 👉 https://t.co/Um8JgbcTsb #Security https://t.co/lvtK72LLBQ

    @Cezar_H_Linux

    15 Jan 2026

    59 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Just 24hrs after CVE-2025-47913, CVE-2025-47914 and CVE-2025-58181 hit the @golang ecosystem, the team has remediated the CVEs across the entire @Docker Hardened Images catalog. It is nice to be fast but more importantly, this means security for our customers.

    @cdupuis

    21 Nov 2025

    70 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.•CVE-2026-20297
  2. In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.•CVE-2026-20296
  3. In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.•CVE-2026-20266
  4. In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.•CVE-2026-20258
  5. In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability `edit_saved_search_owner` could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lacks access control.•CVE-2026-20259

References

Sources include official advisories and independent security research.