GitHub Advisoryadvisory · Go

GHSA-qpw4-5x99-6vjp golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

MEDIUM Published 2026-06-25 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-39827
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-924
Reviewed
2026-06-25

Affected packages

• Go golang.org/x/crypto: < 0.52.0 → fixed in 0.52.0

Description

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Related

Alias · CVE (1)

  • CVE-2026-39827 An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually… vulnerability

Weakness · CWE (1)

  • CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel weakness

References