Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (golang.org/x/crypto golang.org/x/crypto/ssh)

CVE-2026-39830

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 0.68 % · percentile 53 (2026-10-30)
State: PUBLISHED
Published: 2026-05-22 02:31 UTC
Updated: 2026-09-18 12:04 UTC
Assigner: Go
NVD status: Modified

Search on…

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Weaknesses (CWE)

CWE-772 — Missing Release of Resource after Effective Lifetime
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat-SADP
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Advisories

GHSA-vgwf-h737-ff37 — golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
GO-2026-5017 — Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

European references

ENISA EUVD · EUVD-2026-31397
GCVE · GCVE-0-2026-39830

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-1281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-1249 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* < 0.52.0

Affected products

Product	Versions
golang.org/x/crypto · golang.org/x/crypto/ssh	affected 0 < 0.52.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (golang.org/x/crypto golang.org/x/crypto/ssh)