go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1,     a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process     using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue. (CVE-2026-32952)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1,
    a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process
    using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue. (CVE-2026-32952)

ID	Name	Product	Family	Type	Severity
329722	openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21436-1)	Nessus	SuSE Local Security Checks	Local	critical
310392	Linux Distros Unpatched Vulnerability : CVE-2026-32952	Nessus	Misc.	Local	high
440792	SCA: security update for github.com/Azure/go-ntlmssp (GHSA-pjcq-xvwq-hhpj)	Tenable Cloud Security	SCA Checks	Local	high
440792	SCA: security update for github.com/Azure/go-ntlmssp (GHSA-pjcq-xvwq-hhpj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-32952

high

Tenable Plugins

critical

high

high

high