CVE-2026-39834

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: 0.47%; 38th pct
KEV: No
Class: oss containerizable; CWE-190

Description

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Affected packages

golang.org/x/crypto

0 → 0.52.0

References

https://go.dev/cl/781663
https://go.dev/issue/79567
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
https://pkg.go.dev/vuln/GO-2026-5020

Status: profiled · ingested 2026-07-23T18:00:18.000Z