CVE-2026-39829
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
| Vendor | golang.org/x/crypto |
| Product | golang.org/x/crypto/ssh |
| Published | May 22, 2026 |
| Last Updated | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for golang.org/x/crypto golang.org/x/crypto/ssh
Be the first to know when new high vulnerabilities affecting golang.org/x/crypto golang.org/x/crypto/ssh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
golang.org/x/crypto / golang.org/x/crypto/ssh
0 < 0.52.0
References
go.dev: https://go.dev/issue/79565 groups.google.com: https://groups.google.com/g/golang-announce/c/a082jnz-LvI go.dev: https://go.dev/cl/781641 go.dev: https://go.dev/cl/781661 pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-5018 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-39829 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2480681 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41019 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36199 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37072 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35833 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29455 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36808 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43692 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26546 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26547 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36207 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40945 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36648 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41036 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36820 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37387 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42146 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41031 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40972 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40974 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40969 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37271 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37268 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37272 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37278 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37286 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37296 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41055 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36883
Credits
NCC Group Cryptography Services, sponsored by Teleport