CVE-2026-78662

HighCVSS 7.5/10Last modified Sep 4, 2026

Description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
golang.org/x/crypto	golang.org/x/crypto/ssh	< 0.56.0

References

https://go.dev/cl/826504Patch
https://go.dev/issue/81316Issue Tracking, Vendor Advisory
https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing List, Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-6354Patch, Vendor Advisory

Timeline

Published: Sep 2, 2026
Last modified: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-786639.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a CVE-2026-786677.5When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excess CVE-2026-786697.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma CVE-2026-78677.8A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user CVE-2026-786737.5IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.CVE-2026-786748.8The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can le CVE-2026-786757.8GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu CVE-2026-786769.8GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values CVE-2026-786777.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsi CVE-2026-786786.5GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S option CVE-2026-786796.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypass CVE-2026-78688.8IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves ad