uplift: go-ntlmssp CVE-2026-32952 (ADFS/NTLM path) #7

Nature

security (already public CVE only)

What and why

Component: github.com/Azure/go-ntlmssp. Pinned to the 2021 pseudo-version v0.0.0-20211209120228-48547f28849e.
Current → target: → v0.1.1 (the fixed release; to be confirmed at stage 3).
Reason: CVE-2026-32952, an out-of-bounds panic on a malicious NTLM challenge. A hostile or MITM'd endpoint could crash saml2aws during NTLM authentication. To confirm which providers reach it at stage 3 (likely pingntlm and the ADFS/NTLM path).

Impacted version

Upstream: unknown – v2.36.19 (every release with the 2021 pin).
Confirmed on (fork tag): to be done at stage 3 (govulncheck plus a reachability check).

Specific risk and its test

Risk: the bump changes NTLM negotiation behaviour for real ADFS/PingNTLM users.
Test: a regression test that feeds a malformed NTLM challenge (from the CVE advisory) through the NTLM path. It must panic or fail on the old pin and fail cleanly on the new one. The existing pkg/provider/pingntlm tests and the harness must still pass. govulncheck ./... must be clean for this CVE.

Upstream links

Issue: Versent#1524

Process notes

Public CVE, so a public issue is allowed (PROCESS.md, Security items). Stage 4: accepted (maintainer batch 1, 2026-10-20). Starts after the harness isolation record lands.