Vulnary
← back to the feed
Critical· 9.1official fix available

CVE-2026-39830

A flaw in Go’s crypto SSH library allowed a malicious SSH peer to send unsolicited global request responses that could fill an internal buffer and block the connection’s read loop, causing a resource leak. The issue has been fixed by discarding such unsolicited responses.

publishedMay 22, 2026
last modifiedAug 4, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
46th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

The vulnerability affects the golang crypto SSH library used in Go applications that establish SSH connections.

02

Real-world impact

An attacker could send crafted SSH messages to a target system, exhausting its resources and potentially causing a denial‑of‑service by preventing the application from processing legitimate traffic.

03

Why this severity

The CVSS score of 9.1 reflects a network‑based attack that requires no privileges or user interaction, has low complexity, and can completely deny availability while also compromising confidentiality.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade your Go installation to the latest release that includes the golang crypto SSH library fix.

NVD-referenced vendor advisory

05

Timeline

  1. May 22, 2026 · May 22, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 19, 2026 · 17d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Aug 4, 2026 · 7h ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactNone
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →