CVE-2026-39829 Overview
CVE-2026-39829 is a denial of service vulnerability in the Go standard library's RSA and DSA public key parsers. The parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. Unauthenticated clients can trigger this condition during public key authentication, making remote exploitation trivial against any service that accepts client-supplied public keys. The fix limits RSA moduli to 8192 bits and validates DSA parameters per FIPS 186-2.
Critical Impact
Unauthenticated remote attackers can exhaust CPU resources for minutes per request, degrading or denying service availability on systems performing public key authentication.
Affected Products
- Go standard library crypto/rsa and crypto/dsa public key parsers
- golang.org/x/crypto/ssh public key authentication paths
- Applications and services written in Go that accept untrusted RSA or DSA public keys
Discovery Timeline
- 2026-05-22 - CVE CVE-2026-39829 published to NVD
- 2026-05-22 - Last updated in NVD database
Technical Details for CVE-2026-39829
Vulnerability Analysis
The vulnerability is an algorithmic complexity flaw classified as CPU exhaustion denial of service. RSA and DSA signature verification operations scale with the size of the key modulus and parameters. When parsers accept arbitrarily large values, a single malformed public key can force the verifier to perform modular exponentiation on multi-megabit integers. Each verification consumes several minutes of CPU time on a single core. An attacker can submit many such keys concurrently, multiplying the resource impact and rendering the host unresponsive to legitimate traffic.
Root Cause
The crypto/rsa and crypto/dsa parsers did not validate the bit length of incoming key parameters before passing them to cryptographic primitives. No upper bound existed on RSA modulus size, and DSA parameters were not checked against the FIPS 186-2 size constraints. Verification routines therefore operated on attacker-controlled big integers of unbounded length, with quadratic or higher computational cost relative to bit width.
Attack Vector
An unauthenticated remote attacker connects to a Go-based service that performs public key authentication, such as an SSH server using golang.org/x/crypto/ssh. The attacker offers a public key whose modulus or DSA parameters are inflated far beyond normal cryptographic sizes. The server invokes signature verification before completing authentication, blocking a worker goroutine for minutes. Repeated connections exhaust available CPU and connection slots.
No verified exploit code is published. See the Go Dev Vulnerability Advisory GO-2026-5018 and Go Dev Issue Tracker #79565 for technical details on the parser behavior and the enforced limits.
Detection Methods for CVE-2026-39829
Indicators of Compromise
- Sustained high CPU utilization on Go-based services performing public key authentication, with no corresponding increase in successful authentications.
- SSH or TLS connection attempts presenting RSA public keys with modulus sizes exceeding 8192 bits or DSA parameters outside FIPS 186-2 sizes.
- Spikes in unauthenticated connection attempts from a small set of source IPs followed by worker thread saturation.
Detection Strategies
- Inspect authentication logs for repeated public key offers from the same source that never complete handshake.
- Capture and analyze offered public keys at the network or application layer to flag oversized RSA moduli and non-compliant DSA parameters.
- Correlate process-level CPU spikes in Go binaries with concurrent inbound connections on authentication ports.
Monitoring Recommendations
- Set alerting thresholds on CPU consumption per authentication worker and on time-to-complete for handshake operations.
- Monitor connection rate and concurrency limits on services exposing public key authentication to the internet.
- Track the Go toolchain and dependency versions across production builds to identify unpatched binaries.
How to Mitigate CVE-2026-39829
Immediate Actions Required
- Rebuild affected Go applications with a patched Go release that enforces the 8192-bit RSA limit and FIPS 186-2 DSA validation.
- Update golang.org/x/crypto to a fixed version and redeploy any service that performs SSH public key authentication.
- Apply network-level rate limiting and connection concurrency caps on exposed authentication endpoints until patched builds are deployed.
Patch Information
Fixes are tracked in Go Dev Change Log #781641 and Go Dev Change Log #781661. The patches cap RSA moduli at 8192 bits and validate DSA parameters against FIPS 186-2. Coordination details are published in the Golang Announcement on Google Groups and the advisory GO-2026-5018.
Workarounds
- Reject public key offers whose serialized length exceeds normal bounds before passing them to the parser.
- Disable DSA public key authentication where operationally feasible, given its limited modern use.
- Place affected services behind a reverse proxy or bastion that terminates and validates key material before invoking the Go verifier.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
