CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Published May 22, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Ubuntu USN Ubuntu USN USN-8447-2 LXD vulnerabilities
Ubuntu USN Ubuntu USN USN-8447-3 Google Guest Agent vulnerabilities
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:29455 cve-icon
https://access.redhat.com/errata/RHSA-2026:35833 cve-icon
https://access.redhat.com/errata/RHSA-2026:36199 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36625 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:36808 cve-icon
https://access.redhat.com/errata/RHSA-2026:37072 cve-icon
https://access.redhat.com/errata/RHSA-2026:37268 cve-icon
https://access.redhat.com/errata/RHSA-2026:37271 cve-icon
https://access.redhat.com/errata/RHSA-2026:37272 cve-icon
https://access.redhat.com/errata/RHSA-2026:37275 cve-icon
https://access.redhat.com/errata/RHSA-2026:37278 cve-icon
https://access.redhat.com/errata/RHSA-2026:37286 cve-icon
https://access.redhat.com/errata/RHSA-2026:37296 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40262 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40969 cve-icon
https://access.redhat.com/errata/RHSA-2026:40972 cve-icon
https://access.redhat.com/errata/RHSA-2026:40974 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41031 cve-icon
https://access.redhat.com/errata/RHSA-2026:41036 cve-icon
https://access.redhat.com/errata/RHSA-2026:41066 cve-icon
https://access.redhat.com/errata/RHSA-2026:42146 cve-icon
https://access.redhat.com/errata/RHSA-2026:42796 cve-icon
https://access.redhat.com/errata/RHSA-2026:43052 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:46885 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:48151 cve-icon
https://access.redhat.com/errata/RHSA-2026:49944 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:52857 cve-icon
https://access.redhat.com/errata/RHSA-2026:52910 cve-icon
https://access.redhat.com/errata/RHSA-2026:54400 cve-icon
https://access.redhat.com/errata/RHSA-2026:54531 cve-icon
https://access.redhat.com/errata/RHSA-2026:57194 cve-icon
https://access.redhat.com/errata/RHSA-2026:57801 cve-icon
https://access.redhat.com/errata/RHSA-2026:59467 cve-icon
https://access.redhat.com/errata/RHSA-2026:60520 cve-icon
https://access.redhat.com/errata/RHSA-2026:61314 cve-icon
https://access.redhat.com/errata/RHSA-2026:65964 cve-icon
https://access.redhat.com/errata/RHSA-2026:66022 cve-icon
https://access.redhat.com/errata/RHSA-2026:66521 cve-icon
https://access.redhat.com/errata/RHSA-2026:67450 cve-icon
https://access.redhat.com/security/cve/CVE-2026-39830 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2480684 cve-icon
https://go.dev/cl/781640 cve-icon cve-icon
https://go.dev/cl/781664 cve-icon cve-icon
https://go.dev/issue/79564 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/a082jnz-LvI cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-5017 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json cve-icon
History
Type Values Removed Values Added
Weaknesses CWE-770
CWE-787
Type Values Removed Values Added
First Time appeared Golang crypto
Weaknesses CWE-119
CPEs cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
Vendors & Products Golang crypto
Type Values Removed Values Added
Weaknesses CWE-770
CWE-787
Type Values Removed Values Added
Weaknesses CWE-770
CWE-787
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Golang
Golang ssh
Vendors & Products Golang
Golang ssh
Type Values Removed Values Added
Weaknesses CWE-770
CWE-787
Type Values Removed Values Added
Description A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Title Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 18, 2026, 12:04 PM
Reserved
Apr 7, 2026, 6:13 PM
Status
Modified
Published
May 22, 2026, 4:16 AM
Modified
Sep 16, 2026, 1:17 PM