CVE-2024-39223

9.8 criticalEPSS 0.7%

Critical (9.8). EPSS 0.7% chance of exploitation in the next 30 days.

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2024-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8wxx-35qc-vp6r	Go	github.com/ginuerzh/gost	<=2.11.5	no fix published
GO-2024-3224	Go	github.com/ginuerzh/gost	all versions	no fix published

References

https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
https://github.com/ginuerzh/gost/issues/1034
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229

Check your stack JSON