What’s Vulnerable › Vulnerabilities

CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-22 · updated 2026-07-23
• Weakness: CWE-924

Description

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Affected products

• golang.org/x/crypto/ssh: before 0.52.0 — fixed in 0.52.0
• Golang.Org/X/Crypto: before 0.52.0 — fixed in 0.52.0

How to fix

Upgrade to a fixed version: golang.org/x/crypto/ssh 0.52.0; Golang.Org/X/Crypto 0.52.0. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/781320
• https://go.dev/issue/35127
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5016

Get alerted when CVE-2026-39827 or the next vulnerability affects your stack