Vulnerability Report: GO-2026-5020
- CVE-2026-39834
- Affects: golang.org/x/crypto
- Published: May 22, 2026
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Affected Packages
-
PathGo VersionsSymbols
-
before v0.52.0
Aliases
References
- https://go.dev/issue/79567
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781663
- https://vuln.go.dev/ID/GO-2026-5020.json
Credits
- NCC Group Cryptography Services, sponsored by Teleport
Feedback
See anything missing or incorrect?
Suggest an edit to this report.