CVE-2026-39834
This vulnerability is an integer overflow in the Go crypto SSH library that can cause an infinite loop when writing large amounts of data. It can lead to denial of service by exhausting resources. The issue has been fixed by using 64‑bit integers for size checks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Go crypto SSH library (golang crypto).
Real-world impact
An attacker could send a very large write request over an SSH channel, causing the server to loop endlessly and send empty packets, exhausting CPU and memory, effectively denying service to legitimate users.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely without authentication, with no user interaction, and it can completely disrupt integrity and availability of the affected system.
What to do about it
- 01Upgrade the Go crypto SSH library to a version that includes the int64 size comparison fix.
- 02Restart any services that use the library to ensure the updated code is loaded.
NVD description
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- go.dev/cl/781663issue tracking
- go.dev/issue/79567issue tracking
- groups.google.com/g/golang-announce/c/a082jnz…mailing list
- pkg.go.dev/vuln/GO-2026-5020vendor advisory