CVE-2026-39827

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39827", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-04-07T18:13:03.528Z", "datePublished": "2026-05-22T02:31:27.064Z", "dateUpdated": "2026-05-22T18:35:40.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T02:31:27.064Z"}, "title": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh", "descriptions": [{"lang": "en", "value": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection."}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/crypto/ssh", "versions": [{"version": "0", "lessThan": "0.52.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "channel.Reject"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-401: Missing Release of Memory after Effective Lifetime"}]}], "references": [{"url": "https://go.dev/issue/35127"}, {"url": "https://go.dev/cl/781320"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5016"}], "credits": [{"lang": "en", "value": "Ziyan Zhou"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-22T18:35:34.770589Z", "id": "CVE-2026-39827", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T18:35:40.472Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39827", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T18:35:34.770589Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T18:35:26.295Z"}}], "cna": {"title": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh", "credits": [{"lang": "en", "value": "Ziyan Zhou"}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh", "versions": [{"status": "affected", "version": "0", "lessThan": "0.52.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "channel.Reject"}]}], "references": [{"url": "https://go.dev/issue/35127"}, {"url": "https://go.dev/cl/781320"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5016"}], "descriptions": [{"lang": "en", "value": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-401: Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T02:31:27.064Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39827", "state": "PUBLISHED", "dateUpdated": "2026-05-22T18:35:40.472Z", "dateReserved": "2026-04-07T18:13:03.528Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-22T02:31:27.064Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/crypto/ssh", "product": "golang.org/x/crypto/ssh", "programRoutines": [{"name": "channel.Reject"}], "vendor": "golang.org/x/crypto", "versions": [{"lessThan": "0.52.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*", "matchCriteriaId": "D540395B-31B8-4B07-8F79-F5C631BBD5C8", "versionEndExcluding": "0.52.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection."}, {"lang": "es", "value": "Un cliente SSH autenticado que abr\u00eda repetidamente canales que eran rechazados por el servidor caus\u00f3 un crecimiento descontrolado de la memoria, lo que finalmente provoc\u00f3 la ca\u00edda del proceso del servidor y afect\u00f3 a todos los usuarios conectados. Los canales rechazados ahora se eliminan correctamente del estado interno de la conexi\u00f3n y se liberan para la recolecci\u00f3n de basura."}], "id": "CVE-2026-39827", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39827", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-22T18:35:34.770589Z", "version": "2.0.3"}}]}, "published": "2026-05-22T04:16:21.497", "references": [{"source": "security@golang.org", "tags": ["Issue Tracking"], "url": "https://go.dev/cl/781320"}, {"source": "security@golang.org", "tags": ["Issue Tracking"], "url": "https://go.dev/issue/35127"}, {"source": "security@golang.org", "tags": ["Mailing List"], "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2026-5016"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-924"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.52.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/crypto/ssh", "source": "cna", "vendor": "golang.org/x/crypto"}, "product": "ssh", "vendor": "golang"}], "created": "2026-05-22T04:30:25.965157+00:00", "updated": "2026-05-26T20:00:15.339741+00:00", "vendors": ["golang", "golang$PRODUCT$ssh"]}