CVE-2026-39834Medium· 6.5▾ SunlitA flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnera…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
0.5% → 0.5%
9.1 → 6.5
critical → medium
Last analysed / modified upstream
A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.
golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write — rated Moderate by Red Hat. Released 2026-05-22, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43692 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:62391 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:66561
Affected packages:
golang.org/x/crypto/ssh < 0.52.0Patched in:
golang.org/x/crypto/ssh 0.52.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39833Medium· 5.5golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)
CVE-2026-39827Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings (CVE-2026-39827)
CVE-2026-39823Medium· 5.4html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
CVE-2026-39826Medium· 5.4html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
CVE-2026-42507Medium· 5.3net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)