Skip to content
fr Sign in
9.1 Critical

CVE-2026-39830 A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the…

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Affected products and versions

Product Affected versions Fixed in
golang.org/x/crypto/ssh 0.52 earliest → < 0.52.0 0.52.0
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
Builds for Red Hat OpenShift Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Confidential Compute Attestation Versions not published
Cryostat 4 Versions not published
External Secrets Operator for Red Hat OpenShift Versions not published
Multicluster Engine for Kubernetes Versions not published
Show the 80 other branches
Product Affected versions Fixed in
OpenShift API for Data Protection Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 8100020260701102925 earliest → < 8100020260701102925.afee755d 8100020260701102925.afee755d
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Dev Workspaces Operator Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Security Profiles Operator Versions not published
Zero Trust Workload Identity Manager Versions not published
Zero Trust Workload Identity Manager - Tech Preview Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Advanced Cluster Security for Kubernetes 4.10 1782891789 earliest → < 1782891789 1782891789
Red Hat Advanced Cluster Security for Kubernetes 4.11 1783352589 earliest → < 1783352589 1783352589
Red Hat Advanced Cluster Security for Kubernetes 4.9 1782891812 earliest → < 1782891812 1782891812
Red Hat OpenShift Builds 1.7.4 1783058284 earliest → < 1783058284 1783058284
RHEM 1.0 for RHEL 9 Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) Versions not published
DevWorkspace Operator 0.42 1782401674 earliest → < 1782401674 1782401674
Red Hat Edge Manager 1.0 1783502445 earliest → < 1783502445 1783502445
Red Hat Trusted Artifact Signer 1.4 1782903492 earliest → < 1782903492 1782903492
Red Hat OpenShift AI 3.3 1782471656 earliest → < 1782471656 1782471656
Red Hat Openshift Data Foundation 4.22 1782934284 earliest → < 1782934284 1782934284
Red Hat Edge Manager 1.1 1784127775 earliest → < 1784127775 1784127775
Red Hat Quay 3.9 1784125838 earliest → < 1784125838 1784125838
Red Hat Trusted Artifact Signer 1.3 1783968644 earliest → < 1783968644 1783968644
RHEM 1.1 for RHEL 10 Versions not published
RHEM 1.1 for RHEL 9 Versions not published
Red Hat OpenShift Builds 1.8.1 1783612163 earliest → < 1783612163 1783612163
Red Hat Quay 3.10 1783750447 earliest → < 1783750447 1783750447
Red Hat Quay 3.16 1783955846 earliest → < 1783955846 1783955846
Red Hat Advanced Cluster Security 4.9 1782891812 earliest → < 1782891812 1782891812
Red Hat OpenShift Builds 1.7.1 1783058284 earliest → < 1783058284 1783058284
Red Hat Quay 3.1 1783750447 earliest → < 1783750447 1783750447
Red Hat Quay 3.12 1784353904 earliest → < 1784353904 1784353904
Red Hat Quay 3.12 1783751865 earliest → < 1783751865 1783751865
OpenShift API for Data Protection 1.6 1784058822 earliest → < 1784058822 1784058822
Red Hat Quay 3.15 1784351966 earliest → < 1784351966 1784351966
multicluster engine for Kubernetes 2.10 1784564438 earliest → < 1784564438 1784564438
Red Hat OpenShift Builds 1.8.0 1783612163 earliest → < 1783612163 1783612163
multicluster engine for Kubernetes 2.8 1784738758 earliest → < 1784738758 1784738758
Cryostat 4 on RHEL 9 4.2 earliest → < 4.2.0-19 4.2.0-19
multicluster engine for Kubernetes 2.1 1784564438 earliest → < 1784564438 1784564438
Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260721142025.63 earliest → < 8080020260721142025.63b34585 8080020260721142025.63b34585
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260721142025.63 earliest → < 8080020260721142025.63b34585 8080020260721142025.63b34585
Red Hat OpenShift Builds 1.7.3 1783058284 earliest → < 1783058284 1783058284
OpenShift API for Data Protection 1.3 1785180878 earliest → < 1785180878 1785180878
Red Hat OpenShift GitOps 1.19 1785149260 earliest → < 1785149260 1785149260
Red Hat OpenShift GitOps 1.20 1785211346 earliest → < 1785211346 1785211346
Cert Manager support for Red Hat OpenShift release 1.19 1786613805 earliest → < 1786613805 1786613805
Red Hat Advanced Cluster Management for Kubernetes 2.16 1786456658 earliest → < 1786456658 1786456658
Red Hat OpenShift GitOps 1.2 1785211346 earliest → < 1785211346 1785211346
multicluster engine for Kubernetes 2.11 1786912006 earliest → < 1786912006 1786912006
OpenShift API for Data Protection 1.4 1786944540 earliest → < 1786944540 1786944540
Red Hat OpenShift AI 3.4 1787089049 earliest → < 1787089049 1787089049
Red Hat OpenShift Container Platform 4.21 1786955316 earliest → < 1786955316 1786955316
ExternalDNS Operator Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Cluster Observability Operator 1.5.2 1787593637 earliest → < 1787593637 1787593637
Cluster Observability Operator 1.5.0 1787593637 earliest → < 1787593637 1787593637
Logging Subsystem for Red Hat OpenShift 6.6 1788439505 earliest → < 1788439505 1788439505
OpenShift API for Data Protection 1.5 1788860461 earliest → < 1788860461 1788860461
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of golang.org/x/crypto/ssh

The 15 CVEs of golang.org/x/crypto/ssh →
CVE-2026-78662 Previously, a channel registered in the mux's chanList is not usable until it is established 7.5 High CVE-2026-56855 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the… 7.5 High CVE-2026-56854 The source-address critical option in the Permissions returned by an authentication callback was only enforced for the… 7.5 High CVE-2026-39834 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal… 9.1 Critical
Track this CVE