6.5
Moyenne
CVE-2026-39827 An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory…
Description
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| golang.org/x/crypto/ssh 0.52 | premières → < 0.52.0 | 0.52.0 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de golang.org/x/crypto/ssh
Les 15 CVE de golang.org/x/crypto/ssh →
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established
7.5
Élevée
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
7.5
Élevée
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
7.5
Élevée
CVE-2026-46595
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
10.0
Critique