CVE-2026-39830

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
References
Link Resource
https://go.dev/cl/781640 Issue Tracking
https://go.dev/cl/781664 Issue Tracking
https://go.dev/issue/79564 Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
https://pkg.go.dev/vuln/GO-2026-5017 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:29455
https://access.redhat.com/errata/RHSA-2026:35833
https://access.redhat.com/errata/RHSA-2026:36199
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36319
https://access.redhat.com/errata/RHSA-2026:36625
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:37072
https://access.redhat.com/errata/RHSA-2026:37268
https://access.redhat.com/errata/RHSA-2026:37271
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:37278
https://access.redhat.com/errata/RHSA-2026:37286
https://access.redhat.com/errata/RHSA-2026:37296
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40969
https://access.redhat.com/errata/RHSA-2026:40972
https://access.redhat.com/errata/RHSA-2026:40974
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:43052
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:46885
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:48151
https://access.redhat.com/errata/RHSA-2026:49944
https://access.redhat.com/errata/RHSA-2026:51033
https://access.redhat.com/errata/RHSA-2026:52857
https://access.redhat.com/errata/RHSA-2026:52910
https://access.redhat.com/errata/RHSA-2026:54400
https://access.redhat.com/errata/RHSA-2026:54531
https://access.redhat.com/errata/RHSA-2026:57194
https://access.redhat.com/errata/RHSA-2026:57801
https://access.redhat.com/errata/RHSA-2026:59467
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/errata/RHSA-2026:61314
https://access.redhat.com/errata/RHSA-2026:65964
https://access.redhat.com/errata/RHSA-2026:66022
https://access.redhat.com/errata/RHSA-2026:66521
https://access.redhat.com/errata/RHSA-2026:67450
https://access.redhat.com/security/cve/CVE-2026-39830
https://bugzilla.redhat.com/show_bug.cgi?id=2480684
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-05-22 04:16

Updated : 2026-09-16 13:17


NVD link : CVE-2026-39830

Mitre link : CVE-2026-39830

CVE.ORG link : CVE-2026-39830


JSON object : View

Products Affected

golang

  • crypto
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-772

Missing Release of Resource after Effective Lifetime