GO-2026-5020

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5020

Import Source

https://vuln.go.dev/ID/GO-2026-5020.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5020

Aliases

CVE-2026-39834

Published

2026-05-22T02:08:34Z

Modified

2026-05-22T02:30:22.784737221Z

Summary

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5020"
}

References

Credits

- NCC Group Cryptography Services, sponsored by Teleport

Affected packages

Go / golang.org/x/crypto

Package

Name: golang.org/x/crypto; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/crypto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.52.0

Ecosystem specific

{
    "imports": [
        {
            "path": "golang.org/x/crypto/ssh",
            "symbols": [
                "Dial",
                "NewClientConn",
                "NewServerConn",
                "Session.CombinedOutput",
                "Session.Output",
                "Session.Run",
                "Session.Shell",
                "Session.Start",
                "channel.Write",
                "channel.WriteExtended",
                "curve25519sha256.Client",
                "curve25519sha256.Server",
                "dhGEXSHA.Client",
                "dhGEXSHA.Server",
                "dhGroup.Client",
                "dhGroup.Server",
                "ecdh.Client",
                "ecdh.Server",
                "extChannel.Write",
                "mlkem768WithCurve25519sha256.Client",
                "mlkem768WithCurve25519sha256.Server"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5020.json"