CVE-2026-39827

NameCVE-2026-39827
DescriptionAn authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1137516

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-go.crypto (PTS)bullseye1:0.0~git20201221.eec23a3-1vulnerable
bookworm1:0.4.0-1vulnerable
trixie1:0.25.0-1vulnerable
forky, sid1:0.52.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-go.cryptosource(unstable)1:0.52.0-11137516

Notes

[bullseye] - golang-go.crypto <postponed> (Limited support, follow bookworm DSAs/point-releases)
https://www.openwall.com/lists/oss-security/2026/05/22/6
https://github.com/golang/go/issues/35127

Search for package or bug name: Reporting problems