CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
| Vendor | golang.org/x/crypto |
| Product | golang.org/x/crypto/ssh |
| Published | May 22, 2026 |
| Last Updated | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for golang.org/x/crypto golang.org/x/crypto/ssh
Be the first to know when new critical vulnerabilities affecting golang.org/x/crypto golang.org/x/crypto/ssh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
golang.org/x/crypto / golang.org/x/crypto/ssh
0 < 0.52.0
References
go.dev: https://go.dev/issue/79564 groups.google.com: https://groups.google.com/g/golang-announce/c/a082jnz-LvI go.dev: https://go.dev/cl/781640 go.dev: https://go.dev/cl/781664 pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-5017 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-39830 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2480684 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41019 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36199 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37072 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35833 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29455 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36808 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43692 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36207 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40945 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37275 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36648 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41036 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37387 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42146 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41031 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40972 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40974 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40969 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37271 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37268 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37272 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37278 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37286 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37296
Credits
NCC Group Cryptography Services, sponsored by Teleport