Skip to content

Instantly share code, notes, and snippets.

@alon710
Created June 26, 2026 05:41
Show Gist options
  • Select an option

  • Save alon710/404c8247b3af526ba72db3d836620396 to your computer and use it in GitHub Desktop.

Select an option

Save alon710/404c8247b3af526ba72db3d836620396 to your computer and use it in GitHub Desktop.
CVE-2026-39829: CVE-2026-39829: Denial of Service in Go SSH Parser - CVE Security Report

CVE-2026-39829: CVE-2026-39829: Denial of Service in Go SSH Parser

CVSS Score: 7.5 Published: 2026-06-25 Full Report: https://cvereports.com/reports/CVE-2026-39829

Summary

A high-severity Denial of Service (DoS) vulnerability exists in the golang.org/x/crypto/ssh package prior to version 0.52.0. The vulnerability is caused by a lack of size and range validation on incoming RSA and DSA public key parameters during SSH authentication. An unauthenticated attacker can submit a crafted public key with pathologically large parameters, triggering intensive CPU computation during signature verification and leading to a complete Denial of Service.

TL;DR

Unauthenticated remote attackers can exhaust SSH server CPU resources by sending public keys with oversized parameters during the authentication handshake.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-1176
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1 Score: 7.5
  • EPSS Score: 0.00304
  • Exploit Status: Proof-of-Concept
  • Affected Module: golang.org/x/crypto/ssh
  • Fixed Version: v0.52.0

Affected Systems

  • Docker
  • containerd
  • HashiCorp Vault
  • Kubernetes Components
  • Gitea
  • Cloudflared
  • golang.org/x/crypto/ssh: < v0.52.0 (Fixed in: v0.52.0)

Mitigation

  • Upgrade the golang.org/x/crypto dependency to v0.52.0 or higher.
  • Recompile all downstream packages to embed the fixed dependency.
  • Limit SSH port access using network-level firewall rules.

Remediation Steps:

  1. Open the go.mod file of your project.
  2. Update the golang.org/x/crypto line to reference v0.52.0 or higher.
  3. Run 'go mod tidy' to update the lockfile.
  4. Rebuild your binaries and redeploy them to production environments.

References


Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment