GHSA-qpw4-5x99-6vjp

Source

https://github.com/advisories/GHSA-qpw4-5x99-6vjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-qpw4-5x99-6vjp/GHSA-qpw4-5x99-6vjp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qpw4-5x99-6vjp

Aliases

Downstream

CGA (4484)

MINI (230)

Published

2026-06-25T22:15:43Z

Modified

2026-09-10T03:50:50Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Details

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Database specific

{
    "cwe_ids":  [
        "CWE-924"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-25T22:15:43Z",
    "nvd_published_at":  "2026-05-22T04:16:21Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.52.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-qpw4-5x99-6vjp/GHSA-qpw4-5x99-6vjp.json"