CVE-2026-39827
CVE-2026-39827 · Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
golang.org/x/crypto/ssh
- Versions
- ≥ 0, < 0.52.0: Affected (semver)
Update to 0.52.0
golang-go.crypto Debian:12
- Versions
- 1:0.10.0-1
- 1:0.12.0-1
- 1:0.13.0-1
- 1:0.14.0-1
- 1:0.16.0-1
- 1:0.17.0-1
- 1:0.18.0-1
- 1:0.19.0-1
- 1:0.21.0-1
- 1:0.22.0-1
- 1:0.23.0-1
- 1:0.24.0-1
- 1:0.24.0-2
- 1:0.25.0-1
- 1:0.25.0-1~bpo12+1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.4.0-1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:13
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:14
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1~bpo13+1
- Affected ranges
- ECOSYSTEM: < 1:0.52.0-1
Update to 1:0.52.0-1
golang-go.crypto Ubuntu:Pro:16.04:LTS
- Versions
- 1:0.0~git20150608-1
- 1:0.0~git20151201.0.7b85b09-2
- 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1
- 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2
- 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:16.04:LTS
- Versions
- 0.20-0ubuntu4
- 0.21-0ubuntu3
- 0.21-0ubuntu5
- 0.22-0ubuntu1
- 0.22-0ubuntu2
- 0.23-0ubuntu1
- 0.23-0ubuntu2
- 0.23-0ubuntu3
- 0.24-0ubuntu2
- 0.24-0ubuntu3
- 0.24-0ubuntu4
- 0.25-0ubuntu1
- 0.26-0ubuntu2
- 0.26-0ubuntu3
- 0.27-0ubuntu1
- 0.27-0ubuntu2
- 2.0.0~beta1-0ubuntu3
- 2.0.0~beta1-0ubuntu4
- 2.0.0~beta2-0ubuntu1
- 2.0.0~beta2-0ubuntu2
- 2.0.0~beta3-0ubuntu1
- 2.0.0~beta3-0ubuntu2
- 2.0.0~beta3-0ubuntu3
- 2.0.0~beta3-0ubuntu4
- 2.0.0~beta4-0ubuntu1
- 2.0.0~beta4-0ubuntu2
- 2.0.0~beta4-0ubuntu3
- 2.0.0~beta4-0ubuntu4
- 2.0.0~beta4-0ubuntu5
- 2.0.0~beta4-0ubuntu6
- 2.0.0~beta4-0ubuntu7
- 2.0.0~rc1-0ubuntu1
- 2.0.0~rc1-0ubuntu2
- 2.0.0~rc1-0ubuntu3
- 2.0.0~rc2-0ubuntu2
- 2.0.0~rc2-0ubuntu3
- 2.0.0~rc3-0ubuntu1
- 2.0.0~rc3-0ubuntu2
- 2.0.0~rc3-0ubuntu3
- 2.0.0~rc3-0ubuntu4
- 2.0.0~rc4-0ubuntu1
- 2.0.0~rc5-0ubuntu1
- 2.0.0~rc6-0ubuntu1
- 2.0.0~rc6-0ubuntu2
- 2.0.0~rc7-0ubuntu1
- 2.0.0~rc7-0ubuntu2
- 2.0.0~rc8-0ubuntu1
- 2.0.0~rc8-0ubuntu2
- 2.0.0~rc8-0ubuntu3
- 2.0.0~rc8-0ubuntu5
- 2.0.0~rc8-0ubuntu6
- 2.0.0~rc8-0ubuntu7
- 2.0.0~rc9-0ubuntu2
- 2.0.0~rc9-0ubuntu3
- 2.0.0~rc9-0ubuntu4
- 2.0.0~rc9-0ubuntu5
- 2.0.0-0ubuntu1
- 2.0.0-0ubuntu2
- 2.0.0-0ubuntu3
- 2.0.0-0ubuntu4
- 2.0.1-0ubuntu1~16.04.1
- 2.0.2-0ubuntu1~16.04.1
- 2.0.3-0ubuntu1~ubuntu16.04.2
- 2.0.4-0ubuntu1~ubuntu16.04.1
- 2.0.5-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.2
- 2.0.9-0ubuntu1~16.04.1
- 2.0.9-0ubuntu1~16.04.2
- 2.0.10-0ubuntu1~16.04.1
- 2.0.10-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.4
- 2.0.11-0ubuntu1~16.04.4+esm1
- 2.0.11-0ubuntu1~16.04.4+esm2
- 2.0.11-0ubuntu1~16.04.4+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:Pro:16.04:LTS
- Versions
- 1.9
- 1.9.1.1
- 1.9.2
- 2.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.5
- 2.0.8
- 2.0.9
- 2.0.10
- 2.11+0.16.04
- 2.12+0.16.04
- 2.13
- 2.14.2~16.04
- 2.15.2ubuntu1
- 2.16ubuntu3
- 2.17.1ubuntu1
- 2.20.1ubuntu1
- 2.21
- 2.22.2
- 2.22.3
- 2.22.6
- 2.23.1
- 2.24.1
- 2.25
- 2.26.10
- 2.27.5
- 2.28.5
- 2.29.4.2
- 2.32.3.2
- 2.32.9
- 2.33.1ubuntu2
- 2.34.2
- 2.34.2ubuntu0.1
- 2.37.4
- 2.37.4ubuntu0.1
- 2.38
- 2.39.2
- 2.39.2ubuntu0.2
- 2.40
- 2.42.1
- 2.45.1
- 2.45.1ubuntu0.2
- 2.46.1
- 2.47.1
- 2.48
- 2.48.3
- 2.54.3+16.04~esm2
- 2.54.3+16.04.0ubuntu0.1~esm3
- 2.54.3+16.04.0ubuntu0.1~esm4
- 2.54.3+16.04.0ubuntu0.1~esm5
- 2.54.3+16.04.0ubuntu0.1~esm6
- 2.61.4ubuntu0.16.04.1+esm1
- 2.61.4ubuntu0.16.04.1+esm2
- 2.61.4ubuntu0.16.04.1+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:Pro:16.04:LTS
- Versions
- 20201217.02-0ubuntu1~16.04.0
- 20230426.00-0ubuntu2~16.04.3
- 20231004.02-0ubuntu1~16.04.1
- 20231004.02-0ubuntu1~16.04.2
- 20240716.00-0ubuntu1~16.04.0
- 20240716.00-0ubuntu1~16.04.0+esm1
- 20240716.00-0ubuntu1~16.04.0+esm2
- 20240716.00-0ubuntu1~16.04.0+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:18.04:LTS
- Versions
- 2.18-0ubuntu6
- 2.19-0ubuntu1
- 2.20-0ubuntu3
- 2.20-0ubuntu4
- 2.21-0ubuntu1
- 2.21-0ubuntu2
- 2.21-0ubuntu3
- 2.21-0ubuntu4
- 3.0.0~beta2-0ubuntu3
- 3.0.0~beta3-0ubuntu3
- 3.0.0~beta5-0ubuntu2
- 3.0.0~beta7-0ubuntu1
- 3.0.0-0ubuntu1
- 3.0.0-0ubuntu2
- 3.0.0-0ubuntu3
- 3.0.0-0ubuntu4
- 3.0.1-0ubuntu1~18.04.1
- 3.0.2-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.2
- 3.0.3-0ubuntu1~18.04.2+esm1
- 3.0.3-0ubuntu1~18.04.2+esm2
- 3.0.3-0ubuntu1~18.04.2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:Pro:18.04:LTS
- Versions
- 2.28.5+17.10
- 2.29.4.1+18.04
- 2.29.4.2+18.04
- 2.31.1+18.04
- 2.32+18.04~pre5
- 2.32+18.04~pre6
- 2.32+18.04
- 2.32.3.2+18.04
- 2.32.5+18.04
- 2.32.8+18.04
- 2.32.9+18.04
- 2.33.1+18.04ubuntu2
- 2.34.2+18.04
- 2.34.2+18.04.1
- 2.37.1+18.04
- 2.37.1.1+18.04
- 2.37.4+18.04
- 2.37.4+18.04.1
- 2.38+18.04
- 2.39.2+18.04
- 2.40+18.04
- 2.42.1+18.04
- 2.45.1+18.04
- 2.45.1+18.04.2
- 2.46.1+18.04
- 2.47.1+18.04
- 2.48+18.04
- 2.48.3+18.04
- 2.49.2+18.04
- 2.51.1+18.04
- 2.54.2+18.04ubuntu1
- 2.54.3+18.04
- 2.54.3+18.04.2ubuntu0.1
- 2.54.3+18.04.2ubuntu0.2
- 2.55.5+18.04
- 2.57.5+18.04
- 2.57.5+18.04ubuntu0.1
- 2.58+18.04
- 2.58+18.04.1
- 2.61.4ubuntu0.18.04.1+esm1
- 2.61.4ubuntu0.18.04.1+esm2
- 2.61.4ubuntu0.18.04.1+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Ubuntu:Pro:18.04:LTS
- Versions
- 1:0.0~git20170629.0.5ef0053-1ubuntu1
- 1:0.0~git20170629.0.5ef0053-1ubuntu2
- 1:0.0~git20170629.0.5ef0053-2
- 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1
- 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2
- 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:Pro:18.04:LTS
- Versions
- 20201217.02-0ubuntu1~18.04.0
- 20210414.00-0ubuntu1~18.04.0
- 20210629.00-0ubuntu1~18.04.1
- 20220622.00-0ubuntu2~18.04.0
- 20220622.00-0ubuntu2~18.04.1
- 20230426.00-0ubuntu2~18.04.0
- 20231004.02-0ubuntu1~18.04.2
- 20231004.02-0ubuntu1~18.04.3
- 20240716.00-0ubuntu1~18.04.0
- 20241011.01-0ubuntu1~18.04.0
- 20241011.01-0ubuntu1~18.04.0+esm1
- 20241011.01-0ubuntu1~18.04.0+esm2
- 20241011.01-0ubuntu1~18.04.0+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:Pro:20.04:LTS
- Versions
- 20201217.02-0ubuntu1~20.04.0
- 20210414.00-0ubuntu1~20.04.0
- 20210629.00-0ubuntu1~20.04.0
- 20220622.00-0ubuntu2~20.04.0
- 20220622.00-0ubuntu2~20.04.2
- 20230426.00-0ubuntu2~20.04.0
- 20231004.02-0ubuntu1~20.04.1
- 20231004.02-0ubuntu1~20.04.2
- 20231004.02-0ubuntu1~20.04.3
- 20231004.02-0ubuntu1~20.04.4
- 20240716.00-0ubuntu1~20.04.0
- 20241011.01-0ubuntu1~20.04.1
- 20250116.00-0ubuntu1~20.04.0
- 20250116.00-0ubuntu1~20.04.0+esm1
- 20250116.00-0ubuntu1~20.04.0+esm2
- 20250116.00-0ubuntu1~20.04.0+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:Pro:20.04:LTS
- Versions
- 2.41+19.10.1
- 2.42.1+20.04
- 2.43.3+git1.8109f8
- 2.44~pre1+20.04
- 2.44+20.04
- 2.44.2+20.04
- 2.44.3+20.04
- 2.45.1+20.04
- 2.45.1+20.04.2
- 2.46.1+20.04
- 2.47.1+20.04
- 2.48+20.04
- 2.48.3+20.04
- 2.49.2+20.04
- 2.51.1+20.04ubuntu2
- 2.54.2+20.04ubuntu2
- 2.54.3+20.04
- 2.54.3+20.04.1
- 2.54.3+20.04.1ubuntu0.1
- 2.54.3+20.04.1ubuntu0.2
- 2.54.3+20.04.1ubuntu0.3
- 2.55.5+20.04
- 2.57.5+20.04
- 2.57.5+20.04ubuntu0.1
- 2.58+20.04
- 2.58+20.04.1
- 2.61.3+20.04
- 2.62+20.04
- 2.63+20.04
- 2.63+20.04ubuntu0.1
- 2.65.3+20.04
- 2.66.1+20.04
- 2.67.1+20.04
- 2.67.1+20.04ubuntu1~esm1
- 2.67.1+20.04ubuntu1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Ubuntu:Pro:20.04:LTS
- Versions
- 1:0.0~git20190701.4def268-2
- 1:0.0~git20200221.2aa609c-1
- 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1
- 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
- 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:22.04:LTS
- Versions
- 20210629.00-0ubuntu1
- 20210629.00-0ubuntu2
- 20220104.00-0ubuntu1
- 20220104.00-0ubuntu2
- 20220622.00-0ubuntu2~22.04.0
- 20220622.00-0ubuntu2~22.04.1
- 20230426.00-0ubuntu2~22.04.0
- 20231004.02-0ubuntu1~22.04.1
- 20231004.02-0ubuntu1~22.04.2
- 20231004.02-0ubuntu1~22.04.3
- 20231004.02-0ubuntu1~22.04.4
- 20231004.02-0ubuntu1~22.04.5
- 20240716.00-0ubuntu1~22.04.0
- 20241011.01-0ubuntu1~22.04.0
- 20250116.00-0ubuntu1~22.04.0
- 20250116.00-0ubuntu1~22.04.1
- 20250116.00-0ubuntu1~22.04.2
- 20250116.00-0ubuntu1~22.04.3
- 20250116.00-0ubuntu1~22.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:22.04:LTS
- Versions
- 2.53+21.10ubuntu1
- 2.54.2+22.04ubuntu1
- 2.54.2+22.04ubuntu2
- 2.54.2+22.04ubuntu3
- 2.54.3+git19.g868fc21+22.04
- 2.54.3+git26.g360067e+22.04
- 2.55.2+22.04
- 2.55.2+22.04.1
- 2.55.3+22.04
- 2.55.3+22.04ubuntu1
- 2.55.5+22.04
- 2.56.2+22.04ubuntu1
- 2.57.4+22.04
- 2.57.5+22.04
- 2.57.5+22.04ubuntu0.1
- 2.58+22.04
- 2.58+22.04.1
- 2.61.3+22.04
- 2.62+22.04
- 2.63+22.04
- 2.63+22.04ubuntu0.1
- 2.65.3+22.04
- 2.66.1+22.04
- 2.67.1+22.04
- 2.68.5+ubuntu22.04.1
- 2.71+ubuntu22.04
- 2.72+ubuntu22.04
- 2.73+ubuntu22.04
- 2.73+ubuntu22.04.1
- 2.74.1+ubuntu22.04.4
- 2.75.2+ubuntu22.04
- 2.76+ubuntu22.04
- 2.76+ubuntu22.04.1
- 2.76.3+ubuntu22.04
- 2.76.3+ubuntu22.04.1
- 2.77.1+ubuntu22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Ubuntu:Pro:22.04:LTS
- Versions
- 1:0.0~git20201221.eec23a3-1
- 1:0.0~git20211202.5770296-1
- 1:0.0~git20211202.5770296-1ubuntu0.1~esm1
- 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
- 1:0.0~git20211202.5770296-1ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:24.04:LTS
- Versions
- 20230426.00-0ubuntu3
- 20231004.02-0ubuntu1
- 20231004.02-0ubuntu3
- 20240213.00-0ubuntu1
- 20240213.00-0ubuntu2
- 20240213.00-0ubuntu3
- 20240213.00-0ubuntu3.1
- 20240213.00-0ubuntu3.2
- 20240716.00-0ubuntu1~24.04.0
- 20240716.00-0ubuntu1~24.04.1
- 20241011.01-0ubuntu1~24.04.0
- 20250116.00-0ubuntu1~24.04.0
- 20250116.00-0ubuntu1~24.04.1
- 20250116.00-0ubuntu1~24.04.2
- 20250116.00-0ubuntu1~24.04.3
- 20250116.00-0ubuntu1~24.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:24.04:LTS
- Versions
- 2.60.4+23.10
- 2.61.3+24.04
- 2.62+24.04build1
- 2.63+24.04
- 2.63+24.04ubuntu0.1
- 2.63.1+24.04
- 2.65.3+24.04
- 2.66.1+24.04
- 2.67.1+24.04
- 2.68.5+ubuntu24.04.1
- 2.71+ubuntu24.04
- 2.72+ubuntu24.04
- 2.73+ubuntu24.04
- 2.73+ubuntu24.04.1
- 2.73+ubuntu24.04.2
- 2.74.1+ubuntu24.04.4
- 2.75.2+ubuntu24.04
- 2.76+ubuntu24.04
- 2.76+ubuntu24.04.1
- 2.76.3+ubuntu24.04
- 2.77.1+ubuntu24.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Ubuntu:Pro:24.04:LTS
- Versions
- 1:0.4.0-1
- 1:0.17.0-1
- 1:0.18.0-1
- 1:0.19.0-1
- 1:0.19.0-1ubuntu0.1~esm1
- 1:0.19.0-1ubuntu0.1~esm2
- 1:0.19.0-1ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Ubuntu:25.10
- Versions
- 1:0.25.0-1
- 1:0.25.0-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:25.10
- Versions
- 20250116.00-0ubuntu2
- 20250506.01-0ubuntu1
- 20250506.01-0ubuntu1.1
- 20250506.01-0ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
snapd Ubuntu:25.10
- Versions
- 2.67.1+25.04
- 2.68.5+ubuntu25.10.2
- 2.71+ubuntu25.10
- 2.71.1+ubuntu25.10.1
- 2.72+ubuntu25.10.2
- 2.73+ubuntu25.10
- 2.73+ubuntu25.10.1
- 2.74.1+ubuntu25.10.4
- 2.75.2+ubuntu25.10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published