GHSA-vgwf-h737-ff37Published

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-39830 · CVE overview and exploitation status

EUVD-2026-31397

GHSA-vgwf-h737-ff37

GO-2026-5017

cve-program · CVE-2026-39830

euvd · EUVD-2026-31397

nvd · CVE-2026-39830

osv · GHSA-vgwf-h737-ff37

osv · GO-2026-5017

Related changes

Linked by CVE identifier

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connectio… · Advisory content revised · 1 Nov 2026
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connectio… · Advisory content revised · 30 Oct 2026