CVE-2026-39830

An attacker acting as a malicious SSH peer sends unsolicited responses to global requests (global request responses), which are placed into an internal library buffer. The buffer fills up, blocking the goroutine responsible for reading connection data. The blocked goroutine cannot be freed by a standard Close() call, resulting in persistent resource leak per affected connection. The fix consists of rejecting unsolicited global responses instead of placing them in the buffer.

An attacker can cause a server resource leak (goroutines, memory) per connection, which at appropriate scale can result in denial of service (DoS) through system resource exhaustion. Additionally, the high CVSS score indicates significant impact on data confidentiality.

Patches available from the vendor should be applied according to references (changes: go.dev/cl/781640 and go.dev/cl/781664). It is recommended to update the golang.org/x/crypto library to a version containing the fix and to monitor announcements on the golang-announce mailing list.

Golang Crypto library (golang.org/x/crypto) — versions indicated in vendor references (go.dev/issue/79564 and pkg.go.dev/vuln/GO-2026-5017)