Bug 2528026 (CVE-2026-78662) - CVE-2026-78662 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding
Summary: CVE-2026-78662 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Se...
Keywords:
Status: NEW
Alias: CVE-2026-78662
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2530664 2530665 2530666 2530668 2530669 2530670 2530672 2530674 2530676 2530694 2530695 2530696 2530697 2530698 2530700 2530701 2530702 2530703 2530761 2530762 2530763 2530764 2530765 2530767 2530768 2530773 2530780 2530782 2530785 2530786 2530787 2530788 2530789 2530790 2530791 2530792 2530793 2530794 2530795 2530796 2530797 2530798 2530799 2530800 2530801 2530802 2530803 2530804 2530805 2530807 2530808 2530811 2530812 2530813 2530814 2530815 2530816 2530817 2530818 2530820 2530822 2530823 2530824 2530825 2530826 2530827 2530829 2530830 2530831 2530832 2530833 2530834 2530835 2530836 2530837 2530838 2530840 2530841 2530843 2530844 2530845 2530846 2530848 2530849 2530850 2530851 2530667 2530678 2530699 2530766 2530770 2530783 2530806 2530819 2530821 2530828 2530842 2530847
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-03 13:41 UTC by OSIDB Bzimport
Modified: 2026-09-09 12:25 UTC (History)
82 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-03 13:41:57 UTC
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.


Note You need to log in before you can comment on or make changes to this bug.