CVE-2026-39827

A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users.

This vulnerability is rated as Moderate severity because it requires valid client credentials to establish an authenticated session before excessive memory consumption can be triggered, impacting availability without compromising data confidentiality or system integrity. Within Red Hat environments, core operating system administration relies on OpenSSH rather than Go-based SSH server implementations. Most Red Hat offerings that vendor this library utilize client-side utilities or standalone cryptographic functions rather than hosting an SSH server endpoint, significantly curtailing practical exposure across default installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.