Vulnerability Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Crypto | < 0.52.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/781640Issue Tracking
- https://go.dev/cl/781664Issue Tracking
- https://go.dev/issue/79564Issue Tracking
- https://groups.google.com/g/golang-announce/c/a082jnz-LvIMailing List
- https://pkg.go.dev/vuln/GO-2026-5017Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:29455
- https://access.redhat.com/errata/RHSA-2026:35833
- https://access.redhat.com/errata/RHSA-2026:36199
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
FAQ
What is CVE-2026-39830?
CVE-2026-39830 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), re...
How severe is CVE-2026-39830?
CVE-2026-39830 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-39830?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Crypto.