DEBIAN-CVE-2026-39830
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-39830
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39830.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-39830
- Upstream
- Published
- 2026-05-22T04:16:22Z
- Modified
- 2026-09-17T08:47:30Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
- References
Affected packages
Debian:12 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1:0.*
1:0.4.0-1
1:0.10.0-1
1:0.12.0-1
1:0.13.0-1
1:0.14.0-1
1:0.16.0-1
1:0.17.0-1
1:0.18.0-1
1:0.19.0-1
1:0.21.0-1
1:0.22.0-1
1:0.23.0-1
1:0.24.0-1
1:0.24.0-2
1:0.25.0-1~bpo12+1
1:0.25.0-1
1:0.33.0-1~exp1
1:0.36.0-1~exp1
1:0.41.0-1~exp1
1:0.42.0-1~exp1
1:0.42.0-1
1:0.42.0-2
1:0.42.0-3
1:0.42.0-4
1:0.43.0-1
1:0.43.0-2
1:0.45.0-1
1:0.46.0-1
1:0.47.0-1
1:0.50.0-1
1:0.52.0-1~bpo13+1
1:0.52.0-1
1:0.53.0-1
1:0.54.0-1
1:0.55.0-1
1:0.56.0-1
Debian:13 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / golang-go.crypto
Package
- Name
- golang-go.crypto
- Purl
- pkg:deb/debian/golang-go.crypto?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:0.52.0-1