CVE-2026-39834

When invoking the Write method on an SSH channel with data exceeding 4GB, the internal payload size calculation is performed on a variable susceptible to integer overflow (CWE-190). The overflow causes the write loop to lose the ability to progress and enters an infinite loop, continuously sending empty packets. The cause is the use of too narrow an integer type that undergoes truncation at values above 2^32 bytes. The fix consists of replacing the size comparison with an int64 type, eliminating the possibility of overflow.

An attacker or faulty software can cause permanent blocking of the process handling the SSH channel (Denial of Service), preventing its further operation. Additionally, sending empty packets instead of proper data violates the integrity of transmitted information.

Apply patches available from the vendor according to the references. The fix was introduced in changelist https://go.dev/cl/781663 — it is recommended to update the golang.org/x/crypto library to a version containing this change. Monitor Go project announcements at https://groups.google.com/g/golang-announce.

Golang Crypto library (golang.org/x/crypto) — versions indicated in vendor references (see: https://pkg.go.dev/vuln/GO-2026-5020)