What is the CVSS score of CVE-2026-39829?

CVE-2026-39829 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of golang.org/x/crypto/ssh are affected by CVE-2026-39829?

The Go crypto/ssh library (golang.org/x/crypto/ssh) versions before 0.52.0 contain a denial-of-service vulnerability allowing unauthenticated attackers to crash SSH services by consuming CPU…. A patch is available.

Is there a public PoC exploit available for CVE-2026-39829?

Yes, a public proof-of-concept exploit is available for CVE-2026-39829. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-39829?

Within 24 hours: Inventory all applications and infrastructure using golang.org/x/crypto/ssh and identify current versions in production. Within 7 days: Deploy golang.org/x/crypto/ssh version 0.52.0 or later across all affected SSH services and applications. Within 30 days: Complete verification that all production systems have been patched and conduct monitoring for exploitation attempts targeting SSH services.

golang.org/x/crypto/ssh CVE-2026-39829

EUVD-2026-31396 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-22 Go

GHSA-w879-237q-wc7r

Jwt Attack Information Disclosure Golang Org X Crypto Ssh

7.5

CVSS 3.1 · Vendor: Go

Severity by source

Vendor (Go) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 19:00 vuln.today

CVSS changed

Jun 02, 2026 - 16:37 NVD

7.5 (None) 7.5 (HIGH)

Patch available

May 22, 2026 - 04:31 EUVD

CVE Published

May 22, 2026 - 02:31 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

AnalysisAI

Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attackers to exhaust CPU on SSH servers by submitting crafted RSA or DSA public keys with oversized parameters during public key authentication. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but the bug is trivial to trigger and the fix has been published by the Go team in CL 781641/781661.

Technical ContextAI

The vulnerability lives in the RSA and DSA public key parsers used by Go's SSH implementation (golang.org/x/crypto/ssh, CPE cpe:2.3:a:golang.org/x/crypto:golang.org/x/crypto/ssh). Prior to the fix, the parsers accepted arbitrarily large RSA moduli and DSA group parameters; signature verification on such oversized parameters performs modular exponentiation whose cost grows polynomially with key size, leading to multi-minute CPU burns per request. CWE-347 (Improper Verification of Cryptographic Signature) is mapped here because verification is performed on attacker-controlled parameters without bounds-checking; the remediation enforces RSA ≤ 8192 bits and FIPS 186-2 validation for DSA, which is a defense-in-depth pattern consistent with mainstream crypto libraries (OpenSSL, libsodium) that gate verification on parameter sanity.

RemediationAI

Vendor-released patch: upgrade golang.org/x/crypto to v0.52.0 or later (go get golang.org/x/crypto@v0.52.0 followed by a rebuild and redeploy of all SSH server binaries), per Go CLs https://go.dev/cl/781641 and https://go.dev/cl/781661 and the announcement at https://groups.google.com/g/golang-announce/c/a082jnz-LvI. Run govulncheck against built binaries to catch transitive consumers. If immediate upgrade is not possible, compensating controls include placing the SSH listener behind a connection-rate-limiting reverse proxy or fail2ban-style throttling on repeated public-key auth attempts from a single source (side effect: may slow legitimate key-roaming clients), restricting SSH to known source ranges via firewall (side effect: breaks ad-hoc access), or, on multi-tenant servers, capping per-process CPU with cgroups so one attacker cannot starve other connections (side effect: legitimate large operations may also get throttled).

More in Jwt Attack

View all

CVE-2013-3900 MEDIUM Act Now

5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL Act Now POC

9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke

CVE-2025-59718 CRITICAL Emergency

9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to

CVE-2025-25291 CRITICAL Act Now POC

9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS

CVE-2025-25292 CRITICAL Act Now POC

9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS

CVE-2022-25898 CRITICAL Act Now POC

9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2024-42004 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti

CVE-2024-41145 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27

CVE-2024-41138 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

CVE-2024-45409 CRITICAL Act Now POC

9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t

CVE-2022-35929 CRITICAL Act Now POC

9.8 Aug 04

cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote

CVE-2022-31053 CRITICAL Act Now POC

9.8 Jun 13

Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all

CVE-2013-3900 MEDIUM

5.5

CVE-2026-48558 CRITICAL POC

9.5

CVE-2025-59718 CRITICAL

9.8

CVE-2025-47827 MEDIUM POC

4.6

CVE-2025-25291 CRITICAL POC

9.3

CVE-2025-25292 CRITICAL POC

9.3

CVE-2022-25898 CRITICAL POC

9.8

CVE-2024-42004 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for HPC 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected

CVE-2026-39829 vulnerability details – vuln.today

Back

golang.org/x/crypto/ssh CVE-2026-39829

Severity by source

CVSS VectorVendor: Go

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Jwt Attack

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code