An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/781320 | Issue Tracking |
| https://go.dev/issue/35127 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/a082jnz-LvI | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5016 | Vendor Advisory |
Configurations
History
26 May 2026, 17:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://go.dev/cl/781320 - Issue Tracking | |
| References | () https://go.dev/issue/35127 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/a082jnz-LvI - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-5016 - Vendor Advisory | |
| CWE | CWE-924 | |
| CPE | cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | |
| First Time |
Golang crypto
Golang |
22 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
22 May 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 04:16
Updated : 2026-05-26 17:58
NVD link : CVE-2026-39827
Mitre link : CVE-2026-39827
CVE.ORG link : CVE-2026-39827
JSON object : View
Products Affected
golang
- crypto
CWE
CWE-924
Improper Enforcement of Message Integrity During Transmission in a Communication Channel