ZeroDay Findings
Sign inSign up

Findings

CVE-2026-39830

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

Published May 22, 2026 · updated Sep 16, 2026 · golang crypto

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 22, 2026 · NIST NVD

    Detected

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

  2. Sep 16, 2026 · NIST NVD

    Updated

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Affected

  • cpe golang/cryptoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-39830

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-39830

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now

    nvd.nist.gov

References

CVE-2026-39830 · ZeroDay Findings