critical 9.1

CVE-2026-39834 json

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

published 2026-05-22 5 mo ago modified 2026-09-22 48 d ago also EUVD-2026-31400 , GHSA-rm3j-f69w-wqmq , GO-2026-5020

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Patch / fix

fixed in 2 distros 6 links 1

go golang.org/x/crypto 0.52.0
golang.org/x/crypto golang.org/x/crypto/ssh 0.52.0

debian ubuntu red hat suse opensuse azure linux

golang-go.crypto Debian 14 1:0.52.0-1

debian advisories DEBIAN-CVE-2026-39834

google-guest-agent Ubuntu 22.04 LTS 20250116.00-0ubuntu1~22.04.3
google-guest-agent Ubuntu 24.04 LTS 20250116.00-0ubuntu1~24.04.4
google-guest-agent Ubuntu 25.10 20250506.01-0ubuntu1.2
google-guest-agent Ubuntu 26.04 LTS 20250506.01-0ubuntu2.1
lxd Ubuntu Pro 16.04 LTS 2.0.11-0ubuntu1~16.04.4+esm3
lxd Ubuntu Pro 18.04 LTS 3.0.3-0ubuntu1~18.04.2+esm3
golang-go.crypto Ubuntu Pro 16.04 LTS 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2
golang-go.crypto Ubuntu Pro 18.04 LTS 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2026-39834

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

golang1.27 hummingbird 1 1.27.1-0.1.hum1
golang1.27-bin hummingbird 1 1.27.1-0.1.hum1
golang1.27-src hummingbird 1 1.27.1-0.1.hum1
golang1.27-misc hummingbird 1 1.27.1-0.1.hum1
golang1.27-tests hummingbird 1 1.27.1-0.1.hum1
golang1.26 hummingbird 1 1.26.8-0.1.hum1
golang1.26-bin hummingbird 1 1.26.8-0.1.hum1
golang1.26-src hummingbird 1 1.26.8-0.1.hum1

red hat advisories RHSA-2026:66561 RHSA-2026:62391

distribution SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.1-150400.9.41.1
containerized-data-importer SLE Module for Containers 15 SP7 1.64.0-150700.9.14.1
kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.30.1
terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1

suse advisories SUSE-SU-2026:4212-1 SUSE-SU-2026:4209-1 SUSE-SU-2026:3203-1 SUSE-SU-2026:3056-1 SUSE-SU-2026:22613-1 SUSE-SU-2026:2827-1

cloudflared openSUSE Leap 16.0 2026.9.1-bp160.1.1
containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
glab openSUSE Leap 16.0 1.114.0-bp160.1.1
kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
rclone openSUSE Leap 16.0 1.74.4-bp160.1.1
cosign openSUSE Leap 16.0 3.1.1-160000.1.1
alloy openSUSE Leap 16.0 1.17.0-160000.1.1

opensuse advisories openSUSE-SU-2026:21924-1 openSUSE-SU-2026:21824-1 openSUSE-SU-2026:21662-1 openSUSE-SU-2026:21590-1 openSUSE-SU-2026:21483-1 openSUSE-SU-2026:21436-1

cert-manager Azure Linux 3.0 1.12.15-9
cf-cli Azure Linux 3.0 8.7.11-6
docker-buildx Azure Linux 3.0 0.14.0-13
docker-compose Azure Linux 3.0 2.27.0-11
gh Azure Linux 3.0 2.62.0-16
kubernetes Azure Linux 3.0 1.30.10-25
kubevirt Azure Linux 3.0 1.7.1-7
moby-engine Azure Linux 3.0 25.0.3-18

azure linux advisories AZL-87423 AZL-87441 AZL-87648 AZL-87687 AZL-87762 AZL-87933

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.dev/cl/781663 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39834 updated 2026-11-09 cvss 6.5

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, openshift-builds/openshift-builds-image-processing-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/azure-service-operator-rhel9, multicluster-engine/cluster-api-provider-azure-rhel9, multicluster-engine/cluster-api-provider-kubevirt-rhel9
affected: no fix available
Red Hat OpenShift Pipelines openshift-pipelines-client
affected: no fix planned “Will not fix”
Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-must-gather-rhel9 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9

+6 more productsfewer

Red Hat Ceph Storage 8 rhceph/grafana-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10 Red Hat Edge Manager 1 flightctl, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more Red Hat Enterprise Linux 8 rhc, podman, toolbox, podman-tests, podman-docker, podman-remote, +5 more Red Hat Enterprise Linux 9 rhc, podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, +4 more Red Hat Enterprise Linux 10 podman, trustee, gvisor-tap-vsock

affected: no fix available
Red Hat Hardened Images golang1.25
affected: no fix planned “Will not fix”
Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9, rhoai/odh-ogx-module-operator-rhel9, rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 Red Hat OpenShift Container Platform 4 cri-o, podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, +51 more Red Hat OpenShift Container Platform 5 openshift5/ose-tests-rhel9, openshift5/ose-dpu-cni-rhel9, openshift5/ose-dpu-daemon-rhel9, openshift5/ose-hypershift-rhel9, openshift5/oc-mirror-plugin-rhel9, openshift5/ose-dpu-rhel9-operator, +14 more Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9, devspaces/configbump-rhel9 Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator, openshift4-wincw/windows-machine-config-operator-bundle

+6 more productsfewer

Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/gitops-rhel9, openshift-gitops-1/argocd-agent-rhel8, openshift-gitops-1/gitops-rhel8-operator, +2 more Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt Red Hat OpenStack Platform 18.0 rhoso-operators/octavia-rhel9-operator Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/cosign-rhel9, rhtas/fulcio-rhel9, rhtas/gitsign-rhel9, rhtas/rekor-cli-rhel9, rhtas/rekor-server-rhel9, +9 more Red Hat Security Profiles Operator compliance/openshift-security-profiles-rhel8-operator, compliance/openshift-security-profiles-operator-bundle

affected: no fix available
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
fixed: vendor fix RHSA-2026:82322
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1793661985, cluster-observability-operator/perses-rhel9 1793825744, cluster-observability-operator/perses-rhel9-operator 1793663373, cluster-observability-operator/perses-rhel9-operator 1793829951
fixed: vendor fix RHSA-2026:95591
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-19
fixed: vendor fix RHSA-2026:95360

show 6 more

Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/cluster-image-set-controller-rhel9 1792864513
fixed: vendor fix RHSA-2026:92303
Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hypershift-addon-rhel9-operator 1786912006
fixed: vendor fix RHSA-2026:57194
Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1793002792
fixed: vendor fix RHSA-2026:95517
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1793124668, oadp/oadp-mustgather-rhel9 1793124243, oadp/oadp-velero-restic-restore-helper-rhel9 1793124532
fixed: vendor fix RHSA-2026:94498
Red Hat OpenShift API for Data Protection 1.6 oadp/oadp-velero-rhel9 1784058822
fixed: vendor fix RHSA-2026:43692
Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/multicluster-operators-subscription-rhel9 1792886460
fixed: vendor fix RHSA-2026:92307

4 more fixed, 26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-05-22)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	golang.org/x/crypto	<0.52.0	0.52.0

Affected products

golang.org/x/crypto golang.org/x/crypto/ssh

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

References

go.dev /cl/781663
web, issue-tracking, patch
pkg.go.dev /vuln/GO-2026-5020
web, vendor-advisory
go.dev /issue/79567
web, issue-tracking, report
groups.google.com /g/golang-announce/c/a082jnz-LvI
web, mailing-list
nvd.nist.gov /vuln/detail/CVE-2026-39834
advisory
cs.opensource.google /go/x/crypto
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary