CVE-2026-39830

CRITICAL

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Title source: cna
STIX 2.1

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

References (45)

Core 45
Core References

Scores

CVSS v3 9.1
EPSS 0.0062
EPSS Percentile 46.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-119 CWE-772
Status published
Products (3)
golang/crypto < 0.52.0
golang.org/x/crypto/golang.org/x/crypto/ssh < 0.52.0
x/crypto 0 - 0.52.0Go
Published May 22, 2026
Tracked Since May 22, 2026