VULNERABILITY INTELLIGENCE

CVE-2026-39830

CVSS score9.1 CRITICAL
EPSS probability0.68%
CISA KEVNot currently listed
Published2026-05-22
Last modified2026-09-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Weakness classification

  • nvd@nist.gov: CWE-119
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-772

Primary references