CVE-2026-39834

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Critical · published May 22, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00637 · 49.9th percentile
Published
2026-05-22T02:31Z
EPSS history
Timeline
  • 22 MAY 02:31Z
    Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
    cvelistv5