Critical severity · published May 22, 2026
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/crypto/ssh · golang.org/x/crypto
before 0.52.0 · source: vendor
CR
Crypto · Golang
before 0.52.0 · source: NVD
AI
Assisted Installer for Red Hat OpenShift Container Platform 2 · Red Hat
All versions, or not specified · source: CISA
CM
Cert Manager support for Red Hat OpenShift release 1.19 · Red Hat
All versions, or not specified · source: CISA
CO
Cluster Observability Operator 1.5.0 · Red Hat
All versions, or not specified · source: CISA
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: CISA
C4
Cryostat 4 on RHEL 9 · Red Hat
All versions, or not specified · source: CISA
DO
DevWorkspace Operator 0.42 · Red Hat
All versions, or not specified · source: CISA
ES
External Secrets Operator for Red Hat OpenShift · Red Hat
All versions, or not specified · source: CISA
LS
Logging Subsystem for Red Hat OpenShift 6.6 · Red Hat
All versions, or not specified · source: CISA
ME
Multicluster Engine for Kubernetes · Red Hat
All versions, or not specified · source: CISA
OA
OpenShift API for Data Protection 1.3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39830
Issue Tracking
https://go.dev/cl/781640
Issue Tracking
https://go.dev/cl/781664
Issue Tracking
https://go.dev/issue/79564
Mailing List
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-5017
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:29455
More from golang.org/x/crypto/ssh
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.1
CVE-2026-39834
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
9.1
CVE-2026-39831
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
7.5
CVE-2026-56855
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
7.5
CVE-2026-78662
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh