DEBIAN-CVE-2026-39827
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-39827
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39827.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-39827
- Upstream
- Published
- 2026-05-22T04:16:21Z
- Modified
- 2026-09-01T16:06:41Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
- References
Affected packages
Debian:12 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1:0.*
1:0.4.0-1
1:0.10.0-1
1:0.12.0-1
1:0.13.0-1
1:0.14.0-1
1:0.16.0-1
1:0.17.0-1
1:0.18.0-1
1:0.19.0-1
1:0.21.0-1
1:0.22.0-1
1:0.23.0-1
1:0.24.0-1
1:0.24.0-2
1:0.25.0-1~bpo12+1
1:0.25.0-1
1:0.33.0-1~exp1
1:0.36.0-1~exp1
1:0.41.0-1~exp1
1:0.42.0-1~exp1
1:0.42.0-1
1:0.42.0-2
1:0.42.0-3
1:0.42.0-4
1:0.43.0-1
1:0.43.0-2
1:0.45.0-1
1:0.46.0-1
1:0.47.0-1
1:0.50.0-1
1:0.52.0-1~bpo13+1
1:0.52.0-1
1:0.53.0-1
1:0.54.0-1
1:0.55.0-1
Debian:13 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:0.52.0-1