Skip to main content

Go x/crypto SSH EUVDEUVD-2026-31392

| CVE-2026-39827 MEDIUM
Improper Enforcement of Message Integrity During Transmission (CWE-924)
2026-05-22 Go GHSA-qpw4-5x99-6vjp
Denial Of Service Golang Org X Crypto Ssh
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 08, 2026 - 12:40 vuln.today
CVSS changed
May 26, 2026 - 18:07 NVD
6.5 (None) 6.5 (MEDIUM)
Patch available
May 22, 2026 - 04:31 EUVD
CVE Published
May 22, 2026 - 02:31 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

AnalysisAI

Unbounded memory growth in the golang.org/x/crypto/ssh package allows an authenticated remote attacker to crash the SSH server process by repeatedly opening channels that the server rejects. All versions of golang.org/x/crypto/ssh prior to 0.52.0 are affected, and a successful attack disrupts service for every user connected to that server instance. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid SSH credentials
Delivery
Authenticate to target SSH server
Exploit
Send repeated channel-open requests in a tight loop
Execution
Server rejects channels but retains state in memory
Persist
Heap memory grows unbounded
Impact
Server process crashes, disconnecting all active users
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold valid SSH credentials granting authenticated access (PR:L per CVSS vector) to a server process built on the golang.org/x/crypto/ssh package versions prior to 0.52.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: the attack is network-reachable with low complexity, but requires authenticated access (PR:L), which is the primary limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid SSH credentials connects to a server running a vulnerable version of golang.org/x/crypto/ssh and writes a simple loop that continuously sends SSH channel-open requests, each of which the server rejects. Because the server never frees the state for rejected channels, heap memory grows with each iteration until the Go process is killed by the OS OOM killer or panics, abruptly terminating all active SSH sessions on that server. …
Remediation Upgrade golang.org/x/crypto to version 0.52.0 or later, which contains the authoritative fix (go.dev/cl/781320 and go.dev/issue/35127). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Golang Org X Crypto Ssh

View all
CVE-2026-39830 CRITICAL POC
9.1 May 22

Resource exhaustion in the Go golang.org/x/crypto/ssh package allows a malicious SSH peer to leak goroutines and memory

CVE-2026-39829 HIGH POC
7.5 May 22

Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attacker
CVE-2026-39828 MEDIUM POC
6.3 May 22

SSH certificate permission enforcement in golang.org/x/crypto/ssh fails silently during multi-factor authentication flow
CVE-2026-46595 CRITICAL
10.0 May 22

Authorization bypass in the Go golang.org/x/crypto/ssh package before version 0.52.0 allows remote attackers to circumve
CVE-2026-39835 MEDIUM POC
5.3 May 22

Unauthenticated remote clients can crash SSH servers built with golang.org/x/crypto/ssh by presenting a certificate duri
CVE-2026-39834 CRITICAL
9.1 May 22

Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) occurs when an application writes
CVE-2026-39831 CRITICAL
9.1 May 22

Authentication bypass in the Go x/crypto/ssh library (versions before 0.52.0) allows SSH servers to accept FIDO/U2F secu
CVE-2026-46597 HIGH POC
7.5 May 22

Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthenticated att

Same weakness CWE-924 – Improper Enforcement of Message Integrity During Transmission

View all
CVE-2025-0592 HIGH
8.8
CVE-2026-12576 HIGH
7.5
CVE-2026-54891 MEDIUM
6.3
CVE-2024-12399 MEDIUM
6.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP6-CHOST-BYOS-GCE Fixed
SLES15-SP7-CHOST-BYOS-GCE Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

Share

EUVD-2026-31392 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy