Bug 2528026 (CVE-2026-78662)

Summary: CVE-2026-78662 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, akhatavk, akoudelk, amctagga, anjoseph, aoconnor, aos-team-art-private, aruklets, asdas, bniver, cmah, crizzo, dakwon, dhanak, dkeler, doconnor, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, flucifre, gbenhaim, gmeno, gparvin, groman, jburrell, jdelft, jeder, jjoyce, jmatsuok, jmatthew, jprabhak, jpretori, jschluet, jtolenti, jupierce, kingland, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, ngough, niyer, pjindal, ppalepu, ppostler, prdhamdh, rekumar, rhaigner, rhel-process-autobot, rjohnson, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, sostapov, suppawar, thason, twaugh, vereddy, veshanka, vkarehfa, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for legitimate users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2530664, 2530665, 2530666, 2530668, 2530669, 2530670, 2530672, 2530674, 2530676, 2530694, 2530695, 2530696, 2530697, 2530698, 2530700, 2530701, 2530702, 2530703, 2530761, 2530762, 2530763, 2530764, 2530765, 2530767, 2530768, 2530773, 2530780, 2530782, 2530785, 2530786, 2530787, 2530788, 2530789, 2530790, 2530791, 2530792, 2530793, 2530794, 2530795, 2530796, 2530797, 2530798, 2530799, 2530800, 2530801, 2530802, 2530803, 2530804, 2530805, 2530807, 2530808, 2530811, 2530812, 2530813, 2530814, 2530815, 2530816, 2530817, 2530818, 2530820, 2530822, 2530823, 2530824, 2530825, 2530826, 2530827, 2530829, 2530830, 2530831, 2530832, 2530833, 2530834, 2530835, 2530836, 2530837, 2530838, 2530840, 2530841, 2530843, 2530844, 2530845, 2530846, 2530848, 2530849, 2530850, 2530851, 2530667, 2530678, 2530699, 2530766, 2530770, 2530783, 2530806, 2530819, 2530821, 2530828, 2530842, 2530847    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-03 13:41:57 UTC 
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.