DEBIAN-CVE-2026-39834
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-39834
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39834.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-39834
- Upstream
- Published
- 2026-05-22T04:16:24Z
- Modified
- 2026-09-14T17:03:31Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
- References
Affected packages
Debian:12 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1:0.*
1:0.4.0-1
1:0.10.0-1
1:0.12.0-1
1:0.13.0-1
1:0.14.0-1
1:0.16.0-1
1:0.17.0-1
1:0.18.0-1
1:0.19.0-1
1:0.21.0-1
1:0.22.0-1
1:0.23.0-1
1:0.24.0-1
1:0.24.0-2
1:0.25.0-1~bpo12+1
1:0.25.0-1
1:0.33.0-1~exp1
1:0.36.0-1~exp1
1:0.41.0-1~exp1
1:0.42.0-1~exp1
1:0.42.0-1
1:0.42.0-2
1:0.42.0-3
1:0.42.0-4
1:0.43.0-1
1:0.43.0-2
1:0.45.0-1
1:0.46.0-1
1:0.47.0-1
1:0.50.0-1
1:0.52.0-1~bpo13+1
1:0.52.0-1
1:0.53.0-1
1:0.54.0-1
1:0.55.0-1
1:0.56.0-1
Debian:13 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:0.52.0-1