CVE-2026-78662

A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for legitimate users.

A malicious SSH peer can flood a channel with crafted requests before the channel is fully established, causing the affected SSH connection to become unresponsive. This vulnerability does not affect confidentiality or integrity. Red Hat rates this issue as Moderate because the demonstrated availability impact is limited to the affected connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical mitigation that fully prevents this issue while maintaining affected SSH functionality. Where operationally possible, restrict SSH connectivity to trusted systems. Apply relevant Red Hat updates when they become available.