by Kastro CVE-2026-39830
golang.org/x/crypto golang.org/x/crypto/ssh — Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Description · from the CVE record
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Affected
ProductAffectedFixed inSource
golang.org/x/crypto/ssh< 0.52.00.52.0CNA
Cryostat 4 on RHEL 9see advisory4.2.0-19redhat-SADP
Red Hat Enterprise Linux 10see advisory2:1.43.1-3.el10_2redhat-SADP
Red Hat Enterprise Linux 10see advisory7:5.8.2-4.el10_2redhat-SADP
Red Hat Enterprise Linux 8see advisory8100020260701102925.afee755dredhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020260721142025.63b34585redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020260721142025.63b34585redhat-SADP
Red Hat Enterprise Linux 9see advisory2:1.43.1-2.el9_8redhat-SADP
Red Hat Enterprise Linux 9.6 Extended Update Supportsee advisory5:5.4.0-22.el9_6.5redhat-SADP
RHEM 1.0 for RHEL 9see advisory0:1.0.3-1.el9emredhat-SADP
RHEM 1.1 for RHEL 10see advisory0:1.1.3-1.el10emredhat-SADP
RHEM 1.1 for RHEL 9see advisory0:1.1.3-1.el9emredhat-SADP
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial