CVE-2026-39827

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/781320	Issue Tracking
https://go.dev/issue/35127	Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI	Mailing List
https://pkg.go.dev/vuln/GO-2026-5016	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-05-22 04:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-39827

Mitre link : CVE-2026-39827

CVE.ORG link : CVE-2026-39827

JSON object : View

Products Affected

golang

crypto

CWE

CWE-924

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

{"id": "CVE-2026-39827", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39827", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T18:35:34.770589Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh", "versions": [{"status": "affected", "version": "0", "lessThan": "0.52.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "channel.Reject"}]}]}], "published": "2026-05-22T04:16:21.497", "references": [{"url": "https://go.dev/cl/781320", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/35127", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "tags": ["Mailing List"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5016", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-924"}]}], "descriptions": [{"lang": "en", "value": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection."}, {"lang": "es", "value": "Un cliente SSH autenticado que abr\u00eda repetidamente canales que eran rechazados por el servidor caus\u00f3 un crecimiento descontrolado de la memoria, lo que finalmente provoc\u00f3 la ca\u00edda del proceso del servidor y afect\u00f3 a todos los usuarios conectados. Los canales rechazados ahora se eliminan correctamente del estado interno de la conexi\u00f3n y se liberan para la recolecci\u00f3n de basura."}], "lastModified": "2026-07-23T16:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "D540395B-31B8-4B07-8F79-F5C631BBD5C8", "versionEndExcluding": "0.52.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}