# How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library

DevFeed: [How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library](<https://devfeed.tech/articles/how-two-small-bugs-led-to-a-critical-vulnerability-and-a-cryptography-audit-of-go-s-ssh-library-29769.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/ncc-cryptography-audit-go-ssh/>)

Author: info@goteleport.com (Rob Picard)

Published: 2026-08-10T00:00:00Z

Content type: article

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [cryptographic audit](<https://devfeed.tech/topics/cryptographic-audit.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [audit](<https://devfeed.tech/tags/audit.md>), [bugs](<https://devfeed.tech/tags/bugs.md>), [cryptographic-audit](<https://devfeed.tech/tags/cryptographic-audit.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [go](<https://devfeed.tech/tags/go.md>), [security](<https://devfeed.tech/tags/security.md>), [security-engineering](<https://devfeed.tech/tags/security-engineering.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Teleport describes a critical vulnerability caused by two interacting bugs in its SSH certificate validation logic and reports that NCC Group conducted a cryptographic audit of Go's SSH package. The audit resulted in nine CVEs and identified subtle issues requiring expert review.

## Source excerpt

Learn about NCC Group's cryptographic audit of Go's SSH package.