CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
Other sources
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-go.cryptoto a version that resolves this vulnerability.Fixed in 1:0.53.0-1 - Upgrade
Upgrade
go/golang.org/x/crypto/sshto a version that resolves this vulnerability.Fixed in 0.52.0 - Upgrade
Upgrade
golang.org/x/crypto/sshto a version that resolves this vulnerability.Fixed in 19 June 2026
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39834?
The severity of CVE-2026-39834 is rated at 15, indicating a high level of risk.
How do I fix CVE-2026-39834?
To fix CVE-2026-39834, ensure you are using a version of golang.org/x/crypto/ssh that includes the patched comparison using int64.
What type of vulnerability is CVE-2026-39834?
CVE-2026-39834 is categorized as an Integer Overflow vulnerability.
What impact does CVE-2026-39834 have on applications?
CVE-2026-39834 can cause an infinite loop when writing data larger than 4GB on an SSH channel, leading to application unresponsiveness.
When was CVE-2026-39834 published?
CVE-2026-39834 was published on May 22, 2026.