GitHub Advisoryadvisory · Go

GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes

CRITICAL Published 2026-06-25 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-39834
Ecosystem
Go
Packages
golang.org/x/crypto
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-190
Reviewed
2026-06-25

Affected packages

• Go golang.org/x/crypto: < 0.52.0 → fixed in 0.52.0

Description

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Related

Alias · CVE (1)

  • CVE-2026-39834 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References