Vulnerability Description
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Crypto | < 0.56.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/826504Patch
- https://go.dev/issue/81316Issue TrackingVendor Advisory
- https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing ListVendor Advisory
- https://pkg.go.dev/vuln/GO-2026-6354PatchVendor Advisory
FAQ
What is CVE-2026-78662?
CVE-2026-78662 is a vulnerability with a CVSS score of 7.5 (HIGH). Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we...
How severe is CVE-2026-78662?
CVE-2026-78662 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-78662?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Crypto.