PT-2026-42706 · Go+1 · Golang.Org/X/Crypto+1

Ziyan Zhou · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-39827

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated SSH client can cause unbounded memory growth by repeatedly opening channels that are rejected by the server. This leads to the server process crashing, which impacts all connected users. The issue occurs because rejected channels were not being removed from the connection's internal state, preventing them from being released for garbage collection (a process of automatic memory management that reclaims memory occupied by objects no longer in use).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-39827

GO-2026-5016

Affected Products

Golang.Org/X/Crypto

Golang.Org/X/Crypto/Ssh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-39827 · Security Note
• https://osv.dev/vulnerability/GO-2026-5016 · Vendor Advisory
• https://go.dev/issue/35127 · Note
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI · Note
• https://go.dev/cl/781320 · Note
• https://pkg.go.dev/vuln/GO-2026-5016 · Note