CVE-2026-39830
Critical · CVSS 9.1golang.org/x/crypto/ssh — SSH global request response buffer fill / goroutine resource leak (DoS)
- CVSS
- 9.1
- nvd
- EPSS
- 0.62%
- 47th pct
- KEV
- No
- Class
- oss containerizable
- CWE-119, CWE-772
Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Search profile — drives PoC discovery
Symbols globalRequestResponseglobalRequestssendGlobalRequesthandleGlobalRequestsClosereadLooppendingRequestsglobalResponseQueueunsolicited global request responses
Keywords CVE-2026-39830GO-2026-5017golang x/crypto sshunsolicited global request responseSSH goroutine resource leakblocked read loop sshgolang ssh buffer fill DoSCWE-119 CWE-772 golang sshgolang ssh Close resource leak
Versions: golang.org/x/crypto versions prior to the fix in CL 781640 / CL 781664
Affected packages
| Go | golang.org/x/crypto | 0 → 0.52.0 |
References
- https://go.dev/cl/781640
- https://go.dev/cl/781664
- https://go.dev/issue/79564
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5017
- https://access.redhat.com/errata/RHSA-2026:29455
- https://access.redhat.com/errata/RHSA-2026:35833
- https://access.redhat.com/errata/RHSA-2026:36199
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T06:30:14.000Z