CVE-2026-32952: go-ntlmssp Denial of Service Vulnerability

CVE-2026-32952 Overview

CVE-2026-32952 is an Integer Overflow vulnerability affecting go-ntlmssp, a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can cause a slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. This vulnerability allows remote attackers to trigger a denial of service condition through specially crafted NTLM challenge messages sent over the network.

Critical Impact

Remote attackers can crash Go applications using go-ntlmssp for NTLM authentication by sending malicious challenge messages, causing service disruption.

Affected Products

• go-ntlmssp versions prior to 0.1.1
• Go applications using ntlmssp.Negotiator as an HTTP transport
• Services implementing NTLM/Negotiate authentication via the affected library

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-32952 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-32952

Vulnerability Analysis

This vulnerability stems from an integer overflow condition (CWE-190) in the go-ntlmssp package's handling of NTLM challenge messages. When the package processes incoming NTLM challenge messages during authentication negotiation, insufficient bounds checking on message field lengths can lead to an integer overflow. This overflow subsequently causes a slice out of bounds panic when attempting to access memory regions beyond the allocated buffer.

The vulnerability is particularly concerning because it can be triggered remotely by any attacker who can send NTLM challenge messages to an affected application. Since the attack requires no authentication and no user interaction, it represents a straightforward denial of service vector. Any Go application that implements NTLM authentication using the ntlmssp.Negotiator HTTP transport is potentially vulnerable.

Root Cause

The root cause is an integer overflow vulnerability (CWE-190) in the NTLM challenge message parsing logic. When calculating buffer offsets or lengths from fields within the NTLM challenge message, the code does not properly validate that the resulting values will not overflow or exceed the bounds of the allocated slice. A malicious actor can craft an NTLM challenge message with specially chosen field values that trigger the integer overflow, causing the subsequent slice access to panic with an out of bounds error.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Intercepting or initiating an NTLM authentication exchange with a vulnerable application
2. Sending a maliciously crafted NTLM challenge message with field values designed to trigger the integer overflow
3. The vulnerable application parses the challenge message, encounters the overflow condition, and panics
4. The Go process crashes, resulting in denial of service

The vulnerability is exploited through malformed NTLM Type 2 (Challenge) messages. When a client application using go-ntlmssp receives such a message, the parsing routine fails to properly validate numeric fields, leading to the slice bounds violation.

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-pjcq-xvwq-hhpj.

Detection Methods for CVE-2026-32952

Indicators of Compromise

• Unexpected application crashes or restarts in Go services using NTLM authentication
• Panic stack traces showing slice bounds violations in ntlmssp package code
• Unusual NTLM challenge messages with abnormal field lengths in network traffic
• Increased connection attempts to NTLM-authenticated endpoints from suspicious sources

Detection Strategies

• Monitor application logs for Go panic messages originating from the ntlmssp package
• Implement network intrusion detection rules to identify malformed NTLM challenge messages
• Use dependency scanning tools to identify applications using go-ntlmssp versions prior to 0.1.1
• Deploy application performance monitoring to detect unexpected process terminations

Monitoring Recommendations

• Enable verbose logging for NTLM authentication events in affected applications
• Set up alerting for repeated application crashes or restarts
• Monitor network traffic for anomalous NTLM authentication patterns
• Review crash dumps for evidence of slice out of bounds panics in NTLM-related code paths

How to Mitigate CVE-2026-32952

Immediate Actions Required

• Update go-ntlmssp to version 0.1.1 or later immediately
• Audit all Go applications to identify dependencies on the vulnerable package version
• Implement application restart policies to minimize service downtime during attacks
• Consider temporarily disabling NTLM authentication if patching is not immediately possible

Patch Information

The vulnerability has been patched in go-ntlmssp version 0.1.1. Organizations should update their Go module dependencies to include the fixed version. The patch addresses the integer overflow condition by implementing proper bounds checking on NTLM challenge message fields before slice access operations.

For patch details, see the GitHub Release v0.1.1.

Workarounds

• Implement network-level filtering to reject malformed NTLM messages before they reach the application
• Deploy a reverse proxy or web application firewall to inspect NTLM authentication traffic
• Consider using alternative authentication mechanisms if NTLM is not strictly required
• Implement application-level rate limiting on authentication endpoints to reduce attack impact

# Update go-ntlmssp to patched version
go get github.com/Azure/go-ntlmssp@v0.1.1

# Verify the updated version in go.mod
grep go-ntlmssp go.mod
# Expected output: github.com/Azure/go-ntlmssp v0.1.1

# Run go mod tidy to clean up dependencies
go mod tidy