A denial of service vulnerability was found in Go's verification of DSA public keys. An attacker could provide a crafted key to HTTPS client or SSH server libraries which would cause the application to enter an infinite loop.
Go has an infinite loop in several big integer routines that makes Go
programs vulnerable to remote denial of service attacks. Programs using
HTTPS client authentication or the Go ssh server libraries are both exposed
to this vulnerability.
Created golang tracking bugs for this issue:
Affects: fedora-all [bug 1324344]
Affects: epel-6 [bug 1324345]
golang-1.6.1-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
golang-1.5.4-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
golang-1.5.4-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
This was fixed upstream in versions 1.5.4 and 1.6.1. Upstream bug and release notes:
Upstream bug also notes this related change fixing similar problem for rsa and ecdsa, for which no trigger is known: