Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Metrics
CVSS 3.1 9.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh | < 0.52.0 |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | RHEM 1.0 for RHEL 9 | — |
| Red Hat | RHEM 1.1 for RHEL 10 | — |
| Red Hat | RHEM 1.1 for RHEL 9 | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | DevWorkspace Operator 0.42 | — |
| Red Hat | DevWorkspace Operator 0.42 | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.11 | — |
| Red Hat | multicluster engine for Kubernetes 2.8 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.5 | — |
| Red Hat | OpenShift API for Data Protection 1.5 | — |
| Red Hat | OpenShift API for Data Protection 1.6 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
References
- https://go.dev/cl/781640Issue Tracking
- https://go.dev/cl/781664Issue Tracking
- https://go.dev/issue/79564Issue Tracking
- https://groups.google.com/g/golang-announce/c/a082jnz-LvIMailing List
- https://pkg.go.dev/vuln/GO-2026-5017Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:29455
- https://access.redhat.com/errata/RHSA-2026:35833
- https://access.redhat.com/errata/RHSA-2026:36199
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:36808
- https://access.redhat.com/errata/RHSA-2026:37072
- https://access.redhat.com/errata/RHSA-2026:37268
- https://access.redhat.com/errata/RHSA-2026:37271
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:37278
- https://access.redhat.com/errata/RHSA-2026:37286
- https://access.redhat.com/errata/RHSA-2026:37296
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40969
- https://access.redhat.com/errata/RHSA-2026:40972
- https://access.redhat.com/errata/RHSA-2026:40974
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:46885
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49944
- https://access.redhat.com/errata/RHSA-2026:51033
- https://access.redhat.com/errata/RHSA-2026:52857
- https://access.redhat.com/errata/RHSA-2026:52910
- https://access.redhat.com/errata/RHSA-2026:54400
- https://access.redhat.com/errata/RHSA-2026:54531
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:57801
- https://access.redhat.com/errata/RHSA-2026:59467
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:61314
- https://access.redhat.com/errata/RHSA-2026:65964
- https://access.redhat.com/errata/RHSA-2026:66022
- https://access.redhat.com/errata/RHSA-2026:66521
- https://access.redhat.com/errata/RHSA-2026:67450
- https://access.redhat.com/security/cve/CVE-2026-39830
- https://bugzilla.redhat.com/show_bug.cgi?id=2480684
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json
Timeline
- Published
- May 22, 2026
- Last modified
- Sep 16, 2026
- NVD status
- Modified