Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

Yes

Technical impact

Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• golang.org/x/crypto/ssh VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
• golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-rm3j-f69w-wqmq

• Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.52.0
• Fix · GHSA-rm3j-f69w-wqmq golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →

Records fixed by the same vendor advisory or release, as the CNA lists them.

• Release · 2026-05-22

  golang.org/x/crypto/ssh 0.52.0

  9 records · Highest priority Priority MEDIUM · 4 MEDIUM, 5 LOW

  Other records, highest priority first

  • TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshPriority MEDIUM 50
  • TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshPriority MEDIUM 48
  • TI-2026-28712 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshPriority MEDIUM 46
  Show all 9 records →

1. 2026-10-02 Threatist record created from CVE-2026-39834
2. 2026-10-03 Alias added: GHSA-rm3j-f69w-wqmq
3. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
4. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
5. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
6. 2026-10-16 Affected versions changed · Red Hat
7. 2026-10-20 Affected versions changed · Red Hat
8. 2026-10-21 Affected versions changed · Red Hat
9. 2026-10-22 Affected versions changed · Red Hat
10. 2026-10-23 Affected versions changed · Red Hat
11. 2026-10-24 Affected versions changed · Red Hat
12. 2026-10-30 Fix available: RHSA-2026:92303 · Red Hat
13. 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
14. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
15. 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat OpenShift AI 3.4, multicluster engine for Kubernetes 2.8 · Red Hat
16. 2026-10-30 Affected versions changed · Red Hat
17. 2026-11-02 Affected versions changed · Red Hat
18. 2026-11-04 Fix available: RHSA-2026:94498 · Red Hat
19. 2026-11-04 Fix available: OpenShift API for Data Protection 1.4 · Red Hat
20. 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
21. 2026-11-04 Fix available: Cluster Observability Operator 1.5 · Red Hat
22. 2026-11-06 Fix available: Cryostat 4 on RHEL 9, Multicluster Global Hub 1.7.4, Red Hat Trusted Artifact Signer 1.5 · Red Hat
23. 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
24. 2026-11-06 Fix available: RHSA-2026:95517 · Red Hat
25. 2026-11-06 Fix available: RHSA-2026:95263 · Red Hat
26. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat
27. 2026-11-07 Affected versions changed · Red Hat
28. 2026-11-08 Affected versions changed · Red Hat

• TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
• TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
• TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
• TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
• TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
• TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1

• CVE-2026-39834 · CVE Program
• CVE-2026-39834 · NVD
• FIRST EPSS
• GHSA-rm3j-f69w-wqmq · GitHub Advisory Database · CC BY 4.0
• CVE-2026-39834 · Red Hat security data · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences