Vulnerability GO-2026-5016
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 22, 2026 at 02:08 AM UTC
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
v0.1.0 - v0.51.0
v0.1.0 - v0.51.0
Summary
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
Details
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6354
v0.1.0 - v0.55.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6355
v0.1.0 - v0.55.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
v0.1.0 - v0.54.0 GO-2026-6303
v0.1.0 - v0.54.0 GO-2026-6303
Unknown
4 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
v0.1.0 - v0.58.0 GO-2026-5932
v0.1.0 - v0.58.0 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
Impacted packages
Timeline
Published
5 months ago
May 22, 2026 at 02:08 AM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
6 hours ago
November 14, 2026 at 01:12 PM UTC