CVE-2026-39834: Golang Crypto SSH Channel DOS Vulnerability

CVE-2026-39834 Overview

CVE-2026-39834 is an integer overflow vulnerability [CWE-190] in the golang.org/x/crypto SSH package. When an application writes data larger than 4GB in a single Write call on an SSH channel, an integer overflow occurs in the internal payload size calculation. The overflow causes the write loop to spin indefinitely, sending empty packets without making forward progress. The fix changes the size comparison to use int64 to prevent the truncation. The flaw is network-reachable and affects the integrity and availability of any Go service relying on this SSH implementation.

Critical Impact

Attackers who control the size of data passed to an SSH channel Write can trigger an infinite loop, exhausting CPU and stalling SSH sessions on affected Go services.

Affected Products

• golang.org/x/crypto (Go SSH package)
• Go applications importing the vulnerable crypto/ssh module prior to the fixed release referenced in GO-2026-5020
• Server and client implementations using golang.org/x/crypto/ssh channel writes

Discovery Timeline

• 2026-05-22 - CVE-2026-39834 published to the National Vulnerability Database (NVD)
• 2026-05-28 - Last updated in the NVD database

Technical Details for CVE-2026-39834

Vulnerability Analysis

The vulnerability resides in the SSH channel write path of golang.org/x/crypto/ssh. When a caller invokes Write with a buffer larger than 4GB, the internal payload size calculation overflows a 32-bit integer. The truncated value causes the loop condition that tracks remaining bytes to evaluate incorrectly. Instead of breaking after the data is sent, the loop continues to issue zero-length packet writes. The process never advances, consuming CPU and stalling the SSH session.

This class of defect maps to [CWE-190] Integer Overflow or Wraparound. The vendor patch widens the size comparison to int64, eliminating the truncation. The fix is tracked under Go vulnerability identifier GO-2026-5020 and Go change list CL 781663.

Root Cause

The root cause is the use of a narrower integer type in the payload size comparison inside the SSH channel write loop. Writes exceeding math.MaxUint32 wrap around to small values. The loop interprets the wrapped value as remaining work, but no bytes are consumed per iteration. The result is an unbounded loop with empty packet emission.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction in scenarios where an attacker can influence the data length passed to an SSH channel Write. Servers that proxy attacker-controlled data over SSH channels are most exposed. A remote attacker can supply, or cause the application to produce, payloads larger than 4GB to trigger the condition. The result is denial of service through CPU exhaustion and session hang, and an integrity impact because the protocol stream is corrupted by emitted empty packets.

No public proof-of-concept exploit code is published in the references. The vulnerability mechanism is described in the Go issue report (go.dev/issue/79567) and the corresponding change list. See the Go.dev Vulnerability Report for the authoritative technical write-up.

Detection Methods for CVE-2026-39834

Indicators of Compromise

• SSH server or client Go processes consuming sustained 100% CPU on a single goroutine without throughput progress
• Packet captures showing repeated zero-length SSH channel data packets from a Go-based endpoint
• Hung SSH sessions correlated with transfers of files or streams exceeding 4GB
• Application logs reporting stalled ssh.Channel.Write calls that never return

Detection Strategies

• Inventory all Go binaries in the environment and identify those linked against golang.org/x/crypto/ssh below the fixed version listed in GO-2026-5020
• Use govulncheck against build artifacts and running binaries to flag use of the vulnerable symbols
• Add runtime alerts for Go processes whose goroutine count or CPU usage spikes during large SSH transfers
• Monitor SSH channels for sustained streams of zero-length payload packets, which indicate the overflow condition

Monitoring Recommendations

• Track CPU saturation and stuck goroutines on SSH servers handling large data transfers
• Enable network telemetry on TCP/22 and other ports running SSH services backed by Go, and alert on anomalous packet rate with zero payload
• Centralize Go application logs and dependency manifests in a SIEM for continuous detection of vulnerable module versions

How to Mitigate CVE-2026-39834

Immediate Actions Required

• Upgrade golang.org/x/crypto to the fixed version specified in GO-2026-5020 and rebuild all affected Go binaries
• Audit dependency manifests (go.mod, go.sum) across repositories for the vulnerable module
• Restart long-running Go services after rebuild to ensure the patched library is loaded
• Run govulncheck ./... in CI pipelines to block reintroduction of the vulnerable version

Patch Information

The Go team published the fix in change list CL 781663, which replaces the truncating comparison with an int64 comparison in the SSH channel write loop. Track the advisory at the Go.dev Vulnerability Report and review the Go.dev Change Log Entry for the exact source change. Announcement details are available on the Golang Announce Group Post.

Workarounds

• Cap application-level write sizes on SSH channels to less than 4GB per Write call, chunking larger payloads explicitly
• Add input validation that rejects or splits payloads above a safe threshold before they reach ssh.Channel.Write
• Apply network-level rate limits and connection timeouts to constrain the impact of stalled SSH sessions until the patched library is deployed

# Configuration example
# Update the vulnerable module to the fixed version
go get golang.org/x/crypto@latest
go mod tidy

# Scan for residual use of the vulnerable symbols
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...