Research / Finding
nil pointer dereference in publickey() via malformed pem F-SIG-GO-004
Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.
Read the evidence · View in research browse
Recorded evidence
—score not recorded
nil pointer dereference in publickey() via malformed pem
merged
details
Finding IDs F-SIG-GO-004 Status merged Reported date 17 Jan 2026 Rationale prevents crash on malformed pem input. PR opened by @bobcallaway PR state observed closed; GitHub merged: true; 2026-09-24 PR observation basis Public PR metadata recorded in the 2026-09-24 evidence audit; not a live status feed. Contribution boundary Report-associated upstream work; @1seal code authorship is not claimed. Credit, where recorded, is a separate fact. F-SIG-GO-004: Input / state handling. Malformed PEM input reaches a nil dereference. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-SIG-GO-004
Security area (1seal assessment): Availability. Malformed PEM input reaches a nil dereference. Reviewed 24 Sep 2026.
Clarify or correct this record privately . The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy .
How this page groups evidence This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules .