CVE-2026-39834

CRITICAL

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Title source: cna

Description

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

References (4)

Core 4

Core References

https://go.dev/issue/79567

https://groups.google.com/g/golang-announce/c/a082jnz-LvI

https://go.dev/cl/781663

https://pkg.go.dev/vuln/GO-2026-5020

Scores

CVSS v3 9.1

EPSS 0.0039

EPSS Percentile 30.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-190

Status published

Products (2)

golang/crypto < 0.52.0

golang.org/x/crypto/golang.org/x/crypto/ssh < 0.52.0

Published May 22, 2026

Tracked Since May 22, 2026