A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Ubuntu USN Ubuntu USN USN-8447-2 LXD vulnerabilities
Ubuntu USN Ubuntu USN USN-8447-3 Google Guest Agent vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:29455 cve-icon
https://access.redhat.com/errata/RHSA-2026:35833 cve-icon
https://access.redhat.com/errata/RHSA-2026:36199 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36625 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:36808 cve-icon
https://access.redhat.com/errata/RHSA-2026:37072 cve-icon
https://access.redhat.com/errata/RHSA-2026:37268 cve-icon
https://access.redhat.com/errata/RHSA-2026:37271 cve-icon
https://access.redhat.com/errata/RHSA-2026:37272 cve-icon
https://access.redhat.com/errata/RHSA-2026:37275 cve-icon
https://access.redhat.com/errata/RHSA-2026:37278 cve-icon
https://access.redhat.com/errata/RHSA-2026:37286 cve-icon
https://access.redhat.com/errata/RHSA-2026:37296 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40262 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40969 cve-icon
https://access.redhat.com/errata/RHSA-2026:40972 cve-icon
https://access.redhat.com/errata/RHSA-2026:40974 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41031 cve-icon
https://access.redhat.com/errata/RHSA-2026:41036 cve-icon
https://access.redhat.com/errata/RHSA-2026:41066 cve-icon
https://access.redhat.com/errata/RHSA-2026:42146 cve-icon
https://access.redhat.com/errata/RHSA-2026:42796 cve-icon
https://access.redhat.com/errata/RHSA-2026:43052 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:46885 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:48151 cve-icon
https://access.redhat.com/errata/RHSA-2026:49944 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:52857 cve-icon
https://access.redhat.com/errata/RHSA-2026:52910 cve-icon
https://access.redhat.com/errata/RHSA-2026:54400 cve-icon
https://access.redhat.com/security/cve/CVE-2026-39830 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2480684 cve-icon
https://go.dev/cl/781640 cve-icon cve-icon
https://go.dev/cl/781664 cve-icon cve-icon
https://go.dev/issue/79564 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/a082jnz-LvI cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-5017 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json cve-icon
History

Thu, 13 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
References

Tue, 11 Aug 2026 16:00:00 +0000


Tue, 02 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Golang crypto
Weaknesses CWE-119
CPEs cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
Vendors & Products Golang crypto

Fri, 22 May 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
CWE-787

Fri, 22 May 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
CWE-787

Fri, 22 May 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 22 May 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang ssh
Vendors & Products Golang
Golang ssh

Fri, 22 May 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
CWE-787

Fri, 22 May 2026 03:30:00 +0000

Type Values Removed Values Added
Description A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Title Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-13T12:04:24.085Z

Reserved: 2026-04-07T18:13:03.528Z

Link: CVE-2026-39830

cve-icon Vulnrichment

Updated: 2026-08-13T12:04:24.085Z

cve-icon NVD

Status : Modified

Published: 2026-05-22T04:16:22.440

Modified: 2026-08-13T13:18:40.780

Link: CVE-2026-39830

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-02T17:30:13Z

Weaknesses