{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"golang-github-azure-go-ntlmssp","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NRPTHVXCP04KSH6P17RTV9","modified_at":"2026-10-27T09:47:37.812439709Z","published_at":"2026-04-24T03:16:07.833Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-32952","https://security-tracker.debian.org/tracker/CVE-2026-32952"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-32952#Debian:14/golang-github-azure-go-ntlmssp","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-32952"}],"summary":"go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash an"}