CVE-2026-39827

6.5 Moyenne

Publiée le 22/05/2026 à 06:16 · Modifiée le 23/07/2026 à 18:10 · Analysée par le NVD · Source : security@golang.org

Description

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Traduire en français

Produits concernés

golang.org/x/crypto/ssh
Golang crypto

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-924

Références

https://go.dev/cl/781320 Issue Tracking
https://go.dev/issue/35127 Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
https://pkg.go.dev/vuln/GO-2026-5016 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories