Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-39830 Details

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:29455 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:35833 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36199 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36207 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36319 redhat-SADP

see all 60 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer[email protected]
CWE-772Missing Release of Resource after Effective Lifetimeredhat-SADP

Affected Products

ProductVersions
golang crypto
< 0.52.0

CPE

  • cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

Remediation

  • No remediation found in references.

Change History

56 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-39830
NVD Published Date:
May 22, 2026
NVD Last Modified:
Sep 16, 2026
Source:
[email protected]
CVE-2026-39830 Details - Not Deferred