PatchRadar

← Browse

CVE-2026-39830

Medium

Elevated severity or exploit probability.

CVSS base
9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS — probability of exploitation (30 days)
0.6%
48.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-772
Published 2026-05-22 · modified 2026-09-16

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack VectorNNetwork
Attack ComplexityLLow
Privileges RequiredNNone
User InteractionNNone
ScopeUUnchanged
ConfidentialityHHigh
IntegrityNNone
AvailabilityHHigh

Timeline

Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Affected

golang

References

Official: NVD · CVE.org