Bug 2480676 (CVE-2026-39834) - CVE-2026-39834 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
Summary: CVE-2026-39834 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Deni...
Keywords:
Status: NEW
Alias: CVE-2026-39834
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2553132 2553133 2553135 2553138 2553139 2553140 2553142 2553144 2553146 2553150 2553152 2553155 2553157 2553159 2553161 2553163 2553167 2553169 2553171 2553173 2553180 2553183 2553187 2553189 2553191 2553193 2553195 2553197 2553199 2553201 2553203 2553205 2553207 2553209 2553211 2553213 2553215 2553219 2553221 2553225 2553227 2553231 2553234 2553235 2553236 2553237 2553238 2553239 2553241 2553242 2553243 2553244 2553245 2553246 2553249 2553250 2553251 2553253 2553254 2553260 2553261 2553263 2553264 2553267 2553268 2553269 2553270 2553271 2553272 2553273 2553277 2553278 2553282 2553283 2553284 2553285 2553288 2553289 2553290 2553291 2553292 2553294 2553136 2553137 2553148 2553165 2553176 2553217 2553223 2553229 2553247 2553248 2553252 2553255 2553257 2553258 2553259 2553274 2553275 2553276 2553281 2553286 2553287 2553293
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-22 04:01 UTC by OSIDB Bzimport
Modified: 2026-11-04 21:46 UTC (History)
91 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:95360 0 None None None 2026-11-04 21:46:03 UTC

Description OSIDB Bzimport 2026-05-22 04:01:38 UTC 
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Comment 3 Jon Orris 2026-11-04 21:45:58 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:95360 https://access.redhat.com/errata/RHSA-2026:95360
Note You need to log in before you can comment on or make changes to this bug.