CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Other sources
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-go.cryptoto a version that resolves this vulnerability.Fixed in 1:0.53.0-1 - Upgrade
Upgrade
go/golang.org/x/crypto/sshto a version that resolves this vulnerability.Fixed in 0.52.0 - Configuration
Update the ssh implementation so that unsolicited global request responses are discarded (instead of being processed), preventing the internal buffer from filling and blocking the read loop.
golang.org/x/crypto/ssh (SSH client/server) discard unsolicited global request responses = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39830?
The severity of CVE-2026-39830 is rated at risk level 33.
How does CVE-2026-39830 impact Golang's SSH package?
CVE-2026-39830 allows a malicious SSH peer to cause a server deadlock by sending unsolicited global request responses.
What happens when the server encounters CVE-2026-39830?
The server's read loop gets blocked due to a filled internal buffer, leading to a resource leak per connection.
How can I mitigate the effects of CVE-2026-39830?
The mitigation for CVE-2026-39830 involves discarding unsolicited global request responses.
When was CVE-2026-39830 published?
CVE-2026-39830 was published on May 22, 2026.