Bug 2553276 - CVE-2026-39834 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write [fedora-all]
Summary: CVE-2026-39834 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service due to i...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: jfrog-cli
Version: rawhide
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Dominik 'Rathann' Mierzejewski
QA Contact:
URL:
Whiteboard: {"flaws": ["2d749e5e-fe0a-4fae-8339-5...
Depends On:
Blocks: CVE-2026-39834
TreeView+ depends on / blocked
 
Reported: 2026-10-15 10:19 UTC by Avinash Hanwate
Modified: 2026-10-25 00:58 UTC (History)
3 users (show)

Fixed In Version: jfrog-cli-2.127.0-1.el10_3 jfrog-cli-2.127.0-1.el10_4 jfrog-cli-2.127.0-1.el10_2 jfrog-cli-2.127.0-1.fc44 jfrog-cli-2.127.0-1.el9
Clone Of:
Environment:
Last Closed: 2026-10-25 00:30:27 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Avinash Hanwate 2026-10-15 10:19:39 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Comment 1 Fedora Update System 2026-10-16 19:16:36 UTC
FEDORA-EPEL-2026-9c39ca3a3a (jfrog-cli-2.127.0-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9c39ca3a3a

Comment 2 Fedora Update System 2026-10-16 19:16:47 UTC
FEDORA-2026-22413fc041 (jfrog-cli-2.127.0-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-22413fc041

Comment 3 Fedora Update System 2026-10-16 19:16:58 UTC
FEDORA-EPEL-2026-950154172d (jfrog-cli-2.127.0-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-950154172d

Comment 4 Fedora Update System 2026-10-17 01:57:14 UTC
FEDORA-EPEL-2026-5606692ae7 has been pushed to the Fedora EPEL 10.3 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-5606692ae7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-17 01:57:17 UTC
FEDORA-2026-22065c06f7 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-22065c06f7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-22065c06f7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-10-17 02:06:55 UTC
FEDORA-EPEL-2026-950154172d has been pushed to the Fedora EPEL 10.4 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-950154172d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-17 02:13:23 UTC
FEDORA-EPEL-2026-4de78257d4 has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4de78257d4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-10-17 02:23:15 UTC
FEDORA-EPEL-2026-9c39ca3a3a has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9c39ca3a3a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-10-17 02:27:04 UTC
FEDORA-2026-22413fc041 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-22413fc041`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-22413fc041

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-10-25 00:30:27 UTC
FEDORA-EPEL-2026-5606692ae7 (jfrog-cli-2.127.0-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2026-10-25 00:30:40 UTC
FEDORA-EPEL-2026-950154172d (jfrog-cli-2.127.0-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2026-10-25 00:43:42 UTC
FEDORA-EPEL-2026-4de78257d4 (jfrog-cli-2.127.0-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2026-10-25 00:51:44 UTC
FEDORA-2026-22413fc041 (jfrog-cli-2.127.0-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2026-10-25 00:58:44 UTC
FEDORA-EPEL-2026-9c39ca3a3a (jfrog-cli-2.127.0-1.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.