NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2026-39830: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

criticalCVSS 3.1 9.1GHSA-vgwf-h737-ff37

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Published Jun 25, 2026 · Updated Sep 15, 2026

Affected packages

golang.org/x/crypto

Ecosystem
Go
Affected
< 0.52.0
Fixed in
0.52.0
Check
go list -m golang.org/x/crypto

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries