What is the CVSS score of CVE-2026-39829?

CVE-2026-39829 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-39829?

Yes, a public proof-of-concept exploit is available for CVE-2026-39829. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-39829?

Within 24 hours: Inventory all applications and infrastructure using golang.org/x/crypto/ssh and identify current versions in production. Within 7 days: Deploy golang.org/x/crypto/ssh version 0.52.0 or later across all affected SSH services and applications. Within 30 days: Complete verification that all production systems have been patched and conduct monitoring for exploitation attempts targeting SSH services.

golang.org/x/crypto/ssh CVE-2026-39829

Q: Which versions of golang.org/x/crypto/ssh are affected by CVE-2026-39829?

The Go crypto/ssh library (golang.org/x/crypto/ssh) versions before 0.52.0 contain a denial-of-service vulnerability allowing unauthenticated attackers to crash SSH services by consuming CPU…. A patch is available.

EUVD-2026-31396 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-22 Go

GHSA-w879-237q-wc7r

Information Disclosure Jwt Attack Golang Org X Crypto Ssh Golang Org X Crypto

7.5

CVSS 3.1 · Vendor: Go

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify Go-based SSH server on target
Delivery

Open TCP connection to SSH port
Exploit

Send SSH_USERAUTH_REQUEST with oversized RSA/DSA pubkey
Execution

Server enters multi-minute signature verification
Persist

Repeat across connections to exhaust all CPU cores
Impact

SSH service unavailable to legitimate users

Vulnerability Assessment

Weakness	CWE CWE-347 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Signature verification
Exploitation Conditions	The target must be running an SSH server built on golang.org/x/crypto/ssh prior to 0.52.0 with public key authentication enabled (the default on virtually all SSH server configurations) and reachable on the network. No credentials, account, or prior interaction are required - the malicious key is supplied during the unauthenticated SSH_MSG_USERAUTH_REQUEST handshake. Limiting factors: only Go SSH servers using this library are affected (OpenSSH and other implementations are not), impact is confined to CPU/availability with no data exposure, and rate-limiting or IP allowlisting in front of the SSH port effectively blunts the attack.
Impact	Signals are aligned toward 'moderate but unlikely to be mass-exploited.' CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) reflects a pure availability impact reachable pre-authentication over the network - easy to trigger, no user interaction. However, EPSS is just 0.03% (10th percentile), CISA SSVC marks Exploitation:none and Technical Impact:partial (Automatable:yes), and the CVE is not on CISA KEV. Tags from the source feed ('Information Disclosure', 'Jwt Attack') are inconsistent with the actual impact (DoS via SSH pubkey auth) and should be disregarded - they appear to be feed-tagging noise. The realistic risk is repeated-request CPU exhaustion of Go-based SSH servers (e.g., Gerrit, Caddy SSH, Tailscale derivatives), not data compromise; high-value targets are internet-facing SSH services written in Go.
Exploit ScenarioDerived	An attacker opens a TCP connection to a Go-based SSH server and initiates the SSH-USERAUTH 'publickey' method, presenting an RSA public key with a multi-megabit modulus (or a DSA key with oversized p/q). The server attempts to verify the signature on the authentication request, spending several minutes of single-core CPU per request; repeating this from a small botnet trivially saturates all CPUs and denies service to legitimate users. No public exploit identified at time of analysis, but the recipe (oversize RSA modulus in an SSH pubkey blob) is well known from analogous TLS/JWT DoS bugs.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 02, 2026

Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attackers to exhaust CPU on SSH servers by submitting crafted RSA or DSA public keys with oversized parameters during public key authentication. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but the bug is trivial to trigger and the fix has been published by the Go team in CL 781641/781661.

RemediationAI

Vendor-released patch: upgrade golang.org/x/crypto to v0.52.0 or later (go get golang.org/x/crypto@v0.52.0 followed by a rebuild and redeploy of all SSH server binaries), per Go CLs https://go.dev/cl/781641 and https://go.dev/cl/781661 and the announcement at https://groups.google.com/g/golang-announce/c/a082jnz-LvI. Run govulncheck against built binaries to catch transitive consumers. If immediate upgrade is not possible, compensating controls include placing the SSH listener behind a connection-rate-limiting reverse proxy or fail2ban-style throttling on repeated public-key auth attempts from a single source (side effect: may slow legitimate key-roaming clients), restricting SSH to known source ranges via firewall (side effect: breaks ad-hoc access), or, on multi-tenant servers, capping per-process CPU with cgroups so one attacker cannot starve other connections (side effect: legitimate large operations may also get throttled).

Affected VersionsENISA

golang.org/x/crypto/ssh 0 <0.52.0

Affected Packages

go golang.org/x/crypto fix: 0.52.0

go golang.org/x/crypto/ssh fix: 0.52.0

euvd golang_org_x_crypto_ssh fix: 0.52.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in the RSA and DSA public key parsers used by Go's SSH implementation (golang.org/x/crypto/ssh, CPE cpe:2.3:a:golang.org/x/crypto:golang.org/x/crypto/ssh). Prior to the fix, the parsers accepted arbitrarily large RSA moduli and DSA group parameters; signature verification on such oversized parameters performs modular exponentiation whose cost grows polynomially with key size, leading to multi-minute CPU burns per request. CWE-347 (Improper Verification of Cryptographic Signature) is mapped here because verification is performed on attacker-controlled parameters without bounds-checking; the remediation enforces RSA ≤ 8192 bits and FIPS 186-2 validation for DSA, which is a defense-in-depth pattern consistent with mainstream crypto libraries (OpenSSL, libsodium) that gate verification on parameter sanity.

Know when Jwt Attack gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Go) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jun 02, 2026 - 16:37 NVD

7.5 (None) 7.5 (HIGH)

Patch available

May 22, 2026 - 04:31 EUVD

CVE Published

May 22, 2026 - 02:31 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Executive ViewAI

Why It Matters

The Go crypto/ssh library (golang.org/x/crypto/ssh) versions before 0.52.0 contain a denial-of-service vulnerability allowing unauthenticated attackers to crash SSH services by consuming CPU resources with malformed authentication requests. Any organization operating SSH services built with affected versions faces immediate risk of service unavailability; the attack requires no credentials or special access and is trivial to execute.

Business Impact: High

Compensating Controls

Apply vendor patch. Vendor-released patch: golang.org/x/crypto/ssh version 0.52.0 (CL 781641/781661).

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in golang.org/x/crypto SSH Implementation Vulnerabilities

View all 13

CVE-2026-42508 CRITICAL

9.1

CVE-2026-39830 CRITICAL POC

9.1

CVE-2026-46595 CRITICAL

10.0

CVE-2026-39828 MEDIUM POC

6.3

CVE-2026-39835 MEDIUM POC

5.3

CVE-2026-39833 CRITICAL POC

9.1

CVE-2026-39831 CRITICAL

9.1

CVE-2026-39827 MEDIUM POC

6.5

CVE-2026-39834 CRITICAL

9.1

CVE-2026-46597 HIGH POC

7.5

CVE-2026-46598 MEDIUM

5.3

CVE-2026-39832 CRITICAL POC

9.1

More in Jwt Attack

View all

CVE-2013-3900 MEDIUM Act Now

5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL Act Now POC

9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke

CVE-2026-5430 CRITICAL Act Now POC

10.0 Aug 06

Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,

CVE-2025-59718 CRITICAL Emergency

9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to

CVE-2025-25291 CRITICAL Act Now POC

9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS

CVE-2026-47304 CRITICAL Act Now POC

9.8 Jul 14

Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets

CVE-2025-25292 CRITICAL Act Now POC

9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS

CVE-2022-25898 CRITICAL Act Now POC

9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2026-107722 CRITICAL Act Now POC

9.8 Oct 08

Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a

CVE-2024-42004 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti

CVE-2024-41145 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27

CVE-2024-41138 CRITICAL Act Now POC

9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all

CVE-2025-47827 MEDIUM POC

4.6

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for HPC 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back