VULNERABILITY INTELLIGENCE

CVE-2026-78662

CVSS score7.5 HIGH

EPSS probability0.43%

CISA KEVNot currently listed

Published2026-09-02

Last modified2026-09-04

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-770

Primary references

security@golang.org — Patch
security@golang.org — Issue Tracking, Vendor Advisory
security@golang.org — Mailing List, Vendor Advisory
security@golang.org — Patch, Vendor Advisory