{"id":"CVE-2026-39830","title":"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop","summary":"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connec…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-119","CWE-772","CWE-833"],"vendor":"golang","product":"crypto","affected":["crypto < 0.52.0"],"patched":["crypto 0.52.0"],"published":"2026-05-22","updated":"2026-09-16","sourceUpdated":"2026-09-16T13:17:53.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830","references":[{"url":"https://go.dev/cl/781640","label":"security@golang.org"},{"url":"https://go.dev/cl/781664","label":"security@golang.org"},{"url":"https://go.dev/issue/79564","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-5017","label":"security@golang.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:29455","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35833","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36199","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36207","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36648","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36797","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36808","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37072","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37268","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37271","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37278","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37286","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37296","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40969","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40972","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41019","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41036","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:47735","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:49944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51033","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52857","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52910","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54400","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54531","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57801","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59467","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65964","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:67450","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39830","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480684","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830"},{"url":"https://github.com/advisories/GHSA-vgwf-h737-ff37"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39830"},{"url":"https://cs.opensource.google/go/x/crypto"}],"tags":["nvd","ghsa","go","cve.org","csaf","vex","red-hat","osv"],"epss":0.00621,"epssPercentile":0.4843,"aliases":["GHSA-vgwf-h737-ff37","GO-2026-5017"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-22T18:54:26.306252Z"},"scores":{"nvd":9.1,"adp":9.1,"ghsa":9.1,"vendor":7.5,"osv":9.1},"ingestedAt":"2026-06-26T16:43:14.195Z","slug":"CVE-2026-39830","body":"## Overview\n\nA malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.\n\n## Affected\n\n- `crypto < 0.52.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `crypto 0.52.0`\n\n## Package advisory (CVE-2026-39830)\n\nAffected packages:\n\n- `golang.org/x/crypto < 0.52.0`\n\nPatched in:\n\n- `golang.org/x/crypto 0.52.0`\n\nSource: https://github.com/advisories/GHSA-vgwf-h737-ff37\n\n## Vendor advisories\n\n- **RHSA-2026:41019** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41019)\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:36796** · Red Hat · fixed in: RHEM 1.0 for RHEL 9 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36796)\n- **RHSA-2026:36199** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36199)\n- **RHSA-2026:37072** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37072)\n- **RHSA-2026:35833** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35833)\n- **RHSA-2026:49944** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:49944)\n- **RHSA-2026:29455** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:29455)\n- **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:36808** · Red Hat · fixed in: DevWorkspace Operator 0.42 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36808)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Logging Subsystem for Red Hat OpenShift, Multicluster Engine for Kubernetes, OpenShift Pipelines, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201622,"id":"CVE-2026-39830","ts":1789399557484,"field":"cvss","old":"7.5","new":"9.1"},{"seq":201621,"id":"CVE-2026-39830","ts":1789399557484,"field":"severity","old":"high","new":"critical"},{"seq":200354,"id":"CVE-2026-39830","ts":1789397154452,"field":"cvss","old":"9.1","new":"7.5"},{"seq":200353,"id":"CVE-2026-39830","ts":1789397154452,"field":"severity","old":"critical","new":"high"},{"seq":198278,"id":"CVE-2026-39830","ts":1789391790117,"field":"cvss","old":"7.5","new":"9.1"},{"seq":198277,"id":"CVE-2026-39830","ts":1789391790117,"field":"severity","old":"high","new":"critical"},{"seq":196071,"id":"CVE-2026-39830","ts":1789383441011,"field":"cvss","old":"9.1","new":"7.5"},{"seq":196070,"id":"CVE-2026-39830","ts":1789383441011,"field":"severity","old":"critical","new":"high"},{"seq":195000,"id":"CVE-2026-39830","ts":1789380342916,"field":"cvss","old":"7.5","new":"9.1"},{"seq":194999,"id":"CVE-2026-39830","ts":1789380342916,"field":"severity","old":"high","new":"critical"},{"seq":193787,"id":"CVE-2026-39830","ts":1789378306645,"field":"cvss","old":"9.1","new":"7.5"},{"seq":193786,"id":"CVE-2026-39830","ts":1789378306645,"field":"severity","old":"critical","new":"high"},{"seq":192574,"id":"CVE-2026-39830","ts":1789376286988,"field":"cvss","old":"7.5","new":"9.1"},{"seq":192573,"id":"CVE-2026-39830","ts":1789376286988,"field":"severity","old":"high","new":"critical"},{"seq":191361,"id":"CVE-2026-39830","ts":1789373162569,"field":"cvss","old":"9.1","new":"7.5"},{"seq":191360,"id":"CVE-2026-39830","ts":1789373162569,"field":"severity","old":"critical","new":"high"},{"seq":190146,"id":"CVE-2026-39830","ts":1789369160801,"field":"cvss","old":"7.5","new":"9.1"},{"seq":190145,"id":"CVE-2026-39830","ts":1789369160801,"field":"severity","old":"high","new":"critical"},{"seq":188933,"id":"CVE-2026-39830","ts":1789368060302,"field":"cvss","old":"9.1","new":"7.5"},{"seq":188932,"id":"CVE-2026-39830","ts":1789368060302,"field":"severity","old":"critical","new":"high"},{"seq":187716,"id":"CVE-2026-39830","ts":1789365034417,"field":"cvss","old":"7.5","new":"9.1"},{"seq":187715,"id":"CVE-2026-39830","ts":1789365034417,"field":"severity","old":"high","new":"critical"},{"seq":186503,"id":"CVE-2026-39830","ts":1789363048098,"field":"cvss","old":"9.1","new":"7.5"},{"seq":186502,"id":"CVE-2026-39830","ts":1789363048098,"field":"severity","old":"critical","new":"high"},{"seq":185289,"id":"CVE-2026-39830","ts":1789360993814,"field":"cvss","old":"7.5","new":"9.1"},{"seq":185288,"id":"CVE-2026-39830","ts":1789360993814,"field":"severity","old":"high","new":"critical"},{"seq":184076,"id":"CVE-2026-39830","ts":1789357978035,"field":"cvss","old":"9.1","new":"7.5"},{"seq":184075,"id":"CVE-2026-39830","ts":1789357978035,"field":"severity","old":"critical","new":"high"},{"seq":182328,"id":"CVE-2026-39830","ts":1789354136009,"field":"cvss","old":"7.5","new":"9.1"},{"seq":182327,"id":"CVE-2026-39830","ts":1789354136009,"field":"severity","old":"high","new":"critical"},{"seq":181121,"id":"CVE-2026-39830","ts":1789352975279,"field":"cvss","old":"9.1","new":"7.5"},{"seq":181120,"id":"CVE-2026-39830","ts":1789352975279,"field":"severity","old":"critical","new":"high"},{"seq":179914,"id":"CVE-2026-39830","ts":1789350046534,"field":"cvss","old":"7.5","new":"9.1"},{"seq":179913,"id":"CVE-2026-39830","ts":1789350046534,"field":"severity","old":"high","new":"critical"},{"seq":178707,"id":"CVE-2026-39830","ts":1789347886825,"field":"cvss","old":"9.1","new":"7.5"},{"seq":178706,"id":"CVE-2026-39830","ts":1789347886825,"field":"severity","old":"critical","new":"high"},{"seq":177500,"id":"CVE-2026-39830","ts":1789346200201,"field":"cvss","old":"7.5","new":"9.1"},{"seq":177499,"id":"CVE-2026-39830","ts":1789346200201,"field":"severity","old":"high","new":"critical"},{"seq":176293,"id":"CVE-2026-39830","ts":1789342792966,"field":"cvss","old":"9.1","new":"7.5"},{"seq":176292,"id":"CVE-2026-39830","ts":1789342792966,"field":"severity","old":"critical","new":"high"},{"seq":175747,"id":"CVE-2026-39830","ts":1789338583306,"field":"cvss","old":"7.5","new":"9.1"},{"seq":175746,"id":"CVE-2026-39830","ts":1789338583306,"field":"severity","old":"high","new":"critical"},{"seq":175617,"id":"CVE-2026-39830","ts":1789338417649,"field":"cvss","old":"9.1","new":"7.5"},{"seq":175616,"id":"CVE-2026-39830","ts":1789338417649,"field":"severity","old":"critical","new":"high"},{"seq":174412,"id":"CVE-2026-39830","ts":1789334632756,"field":"cvss","old":"7.5","new":"9.1"},{"seq":174411,"id":"CVE-2026-39830","ts":1789334632756,"field":"severity","old":"high","new":"critical"},{"seq":173207,"id":"CVE-2026-39830","ts":1789333262635,"field":"cvss","old":"9.1","new":"7.5"},{"seq":173206,"id":"CVE-2026-39830","ts":1789333262635,"field":"severity","old":"critical","new":"high"},{"seq":172021,"id":"CVE-2026-39830","ts":1789330918742,"field":"cvss","old":"7.5","new":"9.1"},{"seq":172020,"id":"CVE-2026-39830","ts":1789330918742,"field":"severity","old":"high","new":"critical"}]}