Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
cve-program · CVE-2026-39834
PublishedWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Read the publisher's advisoryeuvd · EUVD-2026-31400
PublishedWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Read the publisher's advisorynvd · CVE-2026-39834
PublishedWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Read the publisher's advisoryosv · GHSA-rm3j-f69w-wqmq
PublishedWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Read the publisher's advisoryosv · GO-2026-5020
PublishedWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-39834 · CVE overview and exploitation status
cve-program · CVE-2026-39834
- https://go.dev/issue/79567
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781663
- https://pkg.go.dev/vuln/GO-2026-5020
euvd · EUVD-2026-31400
- https://go.dev/issue/79567
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781663
- https://pkg.go.dev/vuln/GO-2026-5020
nvd · CVE-2026-39834
- https://go.dev/cl/781663
- https://go.dev/issue/79567
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5020
osv · GHSA-rm3j-f69w-wqmq
- https://nvd.nist.gov/vuln/detail/CVE-2026-39834
- https://cs.opensource.google/go/x/crypto
- https://go.dev/cl/781663
- https://go.dev/issue/79567
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5020
osv · GO-2026-5020
Related changes
Linked by CVE identifier- When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size com… · Advisory content revised · 9 Nov 2026
- When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size com… · Advisory content revised · 7 Nov 2026
- When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size com… · Advisory content revised · 1 Nov 2026