CVE-2026-39830

CriticalCVSS 9.1/10Last modified Sep 16, 2026

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119CWE-772

Affected software

No affected versions have been published.

Timeline

Published
May 22, 2026
Last modified
Sep 16, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-398319.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User CVE-2026-398329.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. DCVE-2026-398339.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key woCVE-2026-398349.1When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation cauCVE-2026-398355.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a CVE-2026-398367.5The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).CVE-2026-398375.4Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows CVE-2026-398386.9Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofCVE-2026-398396.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo ExtensCVE-2026-39843.5A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknowCVE-2026-398406.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - CargoCVE-2026-398416.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extens