Critical severity · published May 22, 2026
CVE-2026-39834
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/crypto/ssh · golang.org/x/crypto
before 0.52.0 · source: vendor
CR
Crypto · Golang
before 0.52.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39834
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39834
Issue Tracking
https://go.dev/cl/781663
Issue Tracking
https://go.dev/issue/79567
Mailing List
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-5020
More from golang.org/x/crypto/ssh
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.1
CVE-2026-39831
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
7.5
CVE-2026-56855
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
7.5
CVE-2026-78662
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh