GHSA-vgwf-h737-ff37
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
At a glance
- Published
- Updated
- CVE
- CVE-2026-39830
- Aliases
- GO-2026-5017
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.52.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-39830 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:42796 WEB
- https://access.redhat.com/errata/RHSA-2026:43052 WEB
- https://access.redhat.com/errata/RHSA-2026:43692 WEB
- https://access.redhat.com/errata/RHSA-2026:46885 WEB
- https://access.redhat.com/errata/RHSA-2026:47735 WEB
- https://access.redhat.com/errata/RHSA-2026:48151 WEB
- https://access.redhat.com/errata/RHSA-2026:49944 WEB
- https://access.redhat.com/errata/RHSA-2026:51033 WEB
- https://access.redhat.com/errata/RHSA-2026:52857 WEB
- https://access.redhat.com/errata/RHSA-2026:52910 WEB
- https://access.redhat.com/errata/RHSA-2026:54400 WEB
- https://access.redhat.com/errata/RHSA-2026:54531 WEB
- https://access.redhat.com/errata/RHSA-2026:57194 WEB
- https://access.redhat.com/errata/RHSA-2026:57801 WEB
- https://access.redhat.com/errata/RHSA-2026:59467 WEB
- https://access.redhat.com/errata/RHSA-2026:60520 WEB
- https://access.redhat.com/errata/RHSA-2026:61314 WEB
- https://access.redhat.com/errata/RHSA-2026:65964 WEB
- https://access.redhat.com/errata/RHSA-2026:66022 WEB
- https://access.redhat.com/errata/RHSA-2026:66521 WEB
- https://access.redhat.com/errata/RHSA-2026:67450 WEB
- https://access.redhat.com/security/cve/CVE-2026-39830 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2480684 WEB
- https://cs.opensource.google/go/x/crypto PACKAGE
- https://go.dev/cl/781640 WEB
- https://go.dev/cl/781664 WEB
- https://go.dev/issue/79564 WEB
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB
- https://pkg.go.dev/vuln/GO-2026-5017 WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json WEB
- https://access.redhat.com/errata/RHSA-2026:29455 WEB
- https://access.redhat.com/errata/RHSA-2026:35833 WEB
- https://access.redhat.com/errata/RHSA-2026:36199 WEB
- https://access.redhat.com/errata/RHSA-2026:36207 WEB
- https://access.redhat.com/errata/RHSA-2026:36319 WEB
- https://access.redhat.com/errata/RHSA-2026:36625 WEB
- https://access.redhat.com/errata/RHSA-2026:36648 WEB
- https://access.redhat.com/errata/RHSA-2026:36651 WEB
- https://access.redhat.com/errata/RHSA-2026:36796 WEB
- https://access.redhat.com/errata/RHSA-2026:36797 WEB
- https://access.redhat.com/errata/RHSA-2026:36808 WEB
- https://access.redhat.com/errata/RHSA-2026:37072 WEB
- https://access.redhat.com/errata/RHSA-2026:37268 WEB
- https://access.redhat.com/errata/RHSA-2026:37271 WEB
- https://access.redhat.com/errata/RHSA-2026:37272 WEB
- https://access.redhat.com/errata/RHSA-2026:37275 WEB
- https://access.redhat.com/errata/RHSA-2026:37278 WEB
- https://access.redhat.com/errata/RHSA-2026:37286 WEB
- https://access.redhat.com/errata/RHSA-2026:37296 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |