Vulnerability Report: GO-2026-5016
- CVE-2026-39827
- Affects: golang.org/x/crypto
- Published: May 22, 2026
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
Affected Packages
-
PathGo VersionsSymbols
-
before v0.52.0
1 unexported affected symbols
- channel.Reject
Aliases
References
- https://go.dev/issue/35127
- https://go.dev/cl/781320
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://vuln.go.dev/ID/GO-2026-5016.json
Credits
- Ziyan Zhou
Feedback
See anything missing or incorrect?
Suggest an edit to this report.