CVE-2026-39834

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/781663	Issue Tracking
https://go.dev/issue/79567	Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI	Mailing List
https://pkg.go.dev/vuln/GO-2026-5020	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-05-22 04:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-39834

Mitre link : CVE-2026-39834

CVE.ORG link : CVE-2026-39834

JSON object : View

Products Affected

golang

crypto

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-39834", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39834", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T18:50:30.848292Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh", "versions": [{"status": "affected", "version": "0", "lessThan": "0.52.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "channel.WriteExtended"}, {"name": "Dial"}, {"name": "NewClientConn"}, {"name": "NewServerConn"}, {"name": "Session.CombinedOutput"}, {"name": "Session.Output"}, {"name": "Session.Run"}, {"name": "Session.Shell"}, {"name": "Session.Start"}, {"name": "channel.Write"}, {"name": "curve25519sha256.Client"}, {"name": "curve25519sha256.Server"}, {"name": "dhGEXSHA.Client"}, {"name": "dhGEXSHA.Server"}, {"name": "dhGroup.Client"}, {"name": "dhGroup.Server"}, {"name": "ecdh.Client"}, {"name": "ecdh.Server"}, {"name": "extChannel.Write"}, {"name": "mlkem768WithCurve25519sha256.Client"}, {"name": "mlkem768WithCurve25519sha256.Server"}]}]}], "published": "2026-05-22T04:16:24.237", "references": [{"url": "https://go.dev/cl/781663", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/79567", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "tags": ["Mailing List"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5020", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation."}, {"lang": "es", "value": "Al escribir datos mayores de 4 GB en una sola llamada Write en un canal SSH, un desbordamiento de entero en el c\u00e1lculo interno del tama\u00f1o de la carga \u00fatil hizo que el bucle de escritura girara indefinidamente, enviando paquetes vac\u00edos sin avanzar. La comparaci\u00f3n de tama\u00f1o ahora usa int64 para evitar la truncaci\u00f3n."}], "lastModified": "2026-07-23T16:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "D540395B-31B8-4B07-8F79-F5C631BBD5C8", "versionEndExcluding": "0.52.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}