CVE-2026-39834

A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.

This vulnerability is rated as having a Moderate impact because triggering the condition requires transmitting an unchunked payload exceeding 4GB in a single operation across an SSH channel, which represents an atypical pattern in standard deployments. In typical Red Hat environments and containerized applications consuming this Go package, network communications and data transfers are handled in significantly smaller buffers, substantially limiting realistic exposure. In the event of exploitation, the blast radius is restricted to process hang and denial of service via an infinite loop, without compromising system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.