CVE-2026-39827

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-924

Affected software

Vendor	Product	Versions
golang.org/x/crypto	golang.org/x/crypto/ssh	< 0.52.0

References

https://go.dev/cl/781320Issue Tracking
https://go.dev/issue/35127Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvIMailing List
https://pkg.go.dev/vuln/GO-2026-5016Vendor Advisory

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-398286.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded,CVE-2026-398297.5The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or CVE-2026-39833.5A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part CVE-2026-398309.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The bl CVE-2026-398319.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User CVE-2026-398329.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. D CVE-2026-398339.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key wo CVE-2026-398349.1When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation cau CVE-2026-398355.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a CVE-2026-398367.5The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).CVE-2026-398375.4Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows CVE-2026-398386.9Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - Proof