7.5
High
CVE-2026-39829 The RSA and DSA public key parsers did not enforce size limits on key parameters
Description
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh 0.52 | earliest → < 0.52.0 | 0.52.0 |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| Builds for Red Hat OpenShift | Versions not published | |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| Confidential Compute Attestation | Versions not published | |
| Cryostat 4 | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published |
Show the 88 other branches Hide the 88 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift API for Data Protection | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Advanced Cluster Security 4 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260701102925 | earliest → < 8100020260701102925.afee755d | 8100020260701102925.afee755d |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Dev Workspaces Operator | Versions not published | |
| Red Hat OpenShift for Windows Containers | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift on AWS | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Security Profiles Operator | Versions not published | |
| Zero Trust Workload Identity Manager | Versions not published | |
| Zero Trust Workload Identity Manager - Tech Preview | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1782891789 | earliest → < 1782891789 | 1782891789 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1782891812 | earliest → < 1782891812 | 1782891812 |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 1783352589 | earliest → < 1783352589 | 1783352589 |
| Red Hat OpenShift Builds 1.7.4 1783058284 | earliest → < 1783058284 | 1783058284 |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Versions not published | |
| DevWorkspace Operator 0.42 1782401674 | earliest → < 1782401674 | 1782401674 |
| Red Hat Edge Manager 1.0 1783502445 | earliest → < 1783502445 | 1783502445 |
| Red Hat OpenShift Dev Spaces 3.29 1782403274 | earliest → < 1782403274 | 1782403274 |
| Red Hat Trusted Artifact Signer 1.4 1782903492 | earliest → < 1782903492 | 1782903492 |
| multicluster engine for Kubernetes 2.9 1786764601 | earliest → < 1786764601 | 1786764601 |
| Red Hat Openshift Data Foundation 4.22 1782934284 | earliest → < 1782934284 | 1782934284 |
| multicluster engine for Kubernetes 2.6 1784158679 | earliest → < 1784158679 | 1784158679 |
| Red Hat Edge Manager 1.1 1784127775 | earliest → < 1784127775 | 1784127775 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| Red Hat Trusted Artifact Signer 1.3 1783968644 | earliest → < 1783968644 | 1783968644 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Red Hat OpenShift Builds 1.8.1 1783612163 | earliest → < 1783612163 | 1783612163 |
| Red Hat Quay 3.10 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat Advanced Cluster Security 4.9 1782891812 | earliest → < 1782891812 | 1782891812 |
| Red Hat OpenShift Builds 1.7.1 1783058284 | earliest → < 1783058284 | 1783058284 |
| Red Hat Quay 3.1 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.12 1784353904 | earliest → < 1784353904 | 1784353904 |
| Red Hat Quay 3.12 1783751865 | earliest → < 1783751865 | 1783751865 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| OpenShift API for Data Protection 1.6 1784058822 | earliest → < 1784058822 | 1784058822 |
| multicluster engine for Kubernetes 2.10 1786549100 | earliest → < 1786549100 | 1786549100 |
| multicluster engine for Kubernetes 2.9.0 1782411809 | earliest → < 1782411809 | 1782411809 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1784229508 | earliest → < 1784229508 | 1784229508 |
| Red Hat OpenShift Builds 1.8.0 1783612163 | earliest → < 1783612163 | 1783612163 |
| multicluster engine for Kubernetes 2.8 1784738758 | earliest → < 1784738758 | 1784738758 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-19 | 4.2.0-19 |
| multicluster engine for Kubernetes 2.1 1786549100 | earliest → < 1786549100 | 1786549100 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260721142025.63 | earliest → < 8080020260721142025.63b34585 | 8080020260721142025.63b34585 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260721142025.63 | earliest → < 8080020260721142025.63b34585 | 8080020260721142025.63b34585 |
| Red Hat OpenShift Builds 1.7.3 1783058284 | earliest → < 1783058284 | 1783058284 |
| Red Hat OpenShift Container Platform 4.22 1787037762 | earliest → < 1787037762 | 1787037762 |
| OpenShift API for Data Protection 1.3 1785180878 | earliest → < 1785180878 | 1785180878 |
| Red Hat OpenShift GitOps 1.19 1785149260 | earliest → < 1785149260 | 1785149260 |
| Red Hat OpenShift GitOps 1.20 1785211346 | earliest → < 1785211346 | 1785211346 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1786908777 | earliest → < 1786908777 | 1786908777 |
| Red Hat OpenShift GitOps 1.2 1785211346 | earliest → < 1785211346 | 1785211346 |
| multicluster engine for Kubernetes 2.11 1786912006 | earliest → < 1786912006 | 1786912006 |
| multicluster engine for Kubernetes 2.17 1786837208 | earliest → < 1786837208 | 1786837208 |
| OpenShift API for Data Protection 1.4 1786944540 | earliest → < 1786944540 | 1786944540 |
| Red Hat OpenShift AI 3.4 1787089049 | earliest → < 1787089049 | 1787089049 |
| Red Hat OpenShift Container Platform 4.21 1787555822 | earliest → < 1787555822 | 1787555822 |
| ExternalDNS Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Cluster Observability Operator 1.5.2 1787593637 | earliest → < 1787593637 | 1787593637 |
| Red Hat OpenShift Container Platform 4.20 1787735352 | earliest → < 1787735352 | 1787735352 |
| Red Hat OpenShift Container Platform 4.19 1787545234 | earliest → < 1787545234 | 1787545234 |
| Cluster Observability Operator 1.5.0 1787593637 | earliest → < 1787593637 | 1787593637 |
| Red Hat OpenShift Container Platform 4.2 1787735352 | earliest → < 1787735352 | 1787735352 |
| Red Hat OpenShift AI 2.25 1788181054 | earliest → < 1788181054 | 1788181054 |
| OpenShift API for Data Protection 1.5 1788860461 | earliest → < 1788860461 | 1788860461 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published |
References
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/crypto/ssh
The 15 CVEs of golang.org/x/crypto/ssh →
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established
7.5
High
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
7.5
High
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
7.5
High
CVE-2026-39834
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal…
9.1
Critical