CVE-2026-39830

Summary

golang.org/x/crypto/ssh: Invoking client can cause server deadlock on unexpected responses

Severity

critical

CVSS

9.1

EPSS

0.6% (p48)

CWE

CWE-119

Also known as

GHSA-vgwf-h737-ff37, GO-2026-5017

Published

2026-06-25

Updated

2026-06-25

Advisory details

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

References

• https://github.com/advisories/GHSA-vgwf-h737-ff37
• https://nvd.nist.gov/vuln/detail/CVE-2026-39830
• https://go.dev/cl/781640
• https://go.dev/cl/781664
• https://go.dev/issue/79564
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5017

Related advisories

• CVE-2026-46595 — critical · Go/golang.org/x/crypto/ssh
• CVE-2026-39834 — critical · Go/golang.org/x/crypto/ssh
• CVE-2026-39831 — critical · Go/golang.org/x/crypto/ssh
• CVE-2026-39829 — high · Go/golang.org/x/crypto/ssh
• CVE-2026-46597 — high · Go/golang.org/x/crypto/ssh
• CVE-2026-39827 — medium · Go/golang.org/x/crypto/ssh
• CVE-2026-39835 — medium · Go/golang.org/x/crypto/ssh
• CVE-2026-39828 — medium · Go/golang.org/x/crypto/ssh

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity