https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 06 Jul 2026 07:20:24 +0000 https://vulnerability.circl.lu/sighting/35d5c060-e06d-4fca-9084-7e4f67d32555/export {"uuid": "35d5c060-e06d-4fca-9084-7e4f67d32555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/1194db939e0c9dba565e620e2d426ad0", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:53:04.010867Z"} {"uuid": "35d5c060-e06d-4fca-9084-7e4f67d32555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/1194db939e0c9dba565e620e2d426ad0", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:53:04.010867Z"} https://vulnerability.circl.lu/sighting/35d5c060-e06d-4fca-9084-7e4f67d32555/export Fri, 26 Jun 2026 09:53:04 +0000 https://vulnerability.circl.lu/sighting/04dbaff5-2ba3-46dc-99ed-eb6d93b805c4/export {"uuid": "04dbaff5-2ba3-46dc-99ed-eb6d93b805c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/f98d25db840fda8740b7de9ea64651a9", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:44:13.334697Z"} {"uuid": "04dbaff5-2ba3-46dc-99ed-eb6d93b805c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/f98d25db840fda8740b7de9ea64651a9", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:44:13.334697Z"} https://vulnerability.circl.lu/sighting/04dbaff5-2ba3-46dc-99ed-eb6d93b805c4/export Fri, 26 Jun 2026 09:44:13 +0000 https://vulnerability.circl.lu/sighting/5ccd09fa-ef60-47d9-b6dc-3ca3ab2891ae/export {"uuid": "5ccd09fa-ef60-47d9-b6dc-3ca3ab2891ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/0c57746e41348ce39fa4a70a8b089dd8", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:43:16.361701Z"} {"uuid": "5ccd09fa-ef60-47d9-b6dc-3ca3ab2891ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://gist.github.com/alon710/0c57746e41348ce39fa4a70a8b089dd8", "content": "# CVE-2026-39828: CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39828\n\n## Summary\nA critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.\n\n## TL;DR\nA session state vulnerability in Go's SSH server package allows clients to bypass certificate restrictions (such as forced commands or client source IP bounds) during multi-factor authentication, resulting in unauthorized unrestricted access.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Primary), CWE-295\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.3\n- **EPSS Score**: 0.00175 (7.12% percentile)\n- **Impact**: Authorization Bypass / Privilege Escalation\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Custom SSH servers built with golang.org/x/crypto/ssh\n- Go-based SSH portals and jump servers\n- Go-based bastion hosts and network gateway controls\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto module to version v0.52.0 or newer\n- Modify custom SSH server authentication callbacks to return nil permissions with PartialSuccessError\n- Enforce intermediate verification checks in custom Go SSH connection loops\n\n**Remediation Steps:**\n1. Run 'go get golang.org/x/crypto@v0.52.0' in the project directory\n2. Execute 'go mod tidy' to update go.sum and dependencies\n3. Verify that the project compiles and run existing SSH unit tests\n4. Review custom 'VerifiedPublicKeyCallback' or 'PublicKeyCallback' structures in custom SSH servers to ensure they return nil permissions during partial success\n5. Deploy the rebuilt SSH server binary to staging and production environments\n\n## References\n\n- [Go Issue Tracker Thread #79562](https://go.dev/issue/79562)\n- [Gerrit Code Review / Code Patch](https://go.dev/cl/781621)\n- [Go Vulnerability Advisory GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)\n- [Golang Announce Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T09:43:16.361701Z"} https://vulnerability.circl.lu/sighting/5ccd09fa-ef60-47d9-b6dc-3ca3ab2891ae/export Fri, 26 Jun 2026 09:43:16 +0000 https://vulnerability.circl.lu/sighting/99df6565-39b6-48ed-8f6b-bff6558faa73/export {"uuid": "99df6565-39b6-48ed-8f6b-bff6558faa73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39827", "type": "seen", "source": "https://gist.github.com/alon710/c23e66a189a2d9bd2d0b0916f9459aaf", "content": "# CVE-2026-39827: CVE-2026-39827: Denial of Service via Unbounded Memory Growth in Go SSH (golang.org/x/crypto/ssh)\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39827\n\n## Summary\nAn unbounded memory leak vulnerability in the Go SSH package (golang.org/x/crypto/ssh) allows authenticated users to crash the server by repeatedly requesting connection channels that are rejected, leading to system resource exhaustion.\n\n## TL;DR\nA memory leak in golang.org/x/crypto/ssh prior to version 0.52.0 allows authenticated clients to trigger a Denial of Service by repeatedly sending channel requests that the server rejects.\n\n## Technical Details\n\n- **CWE ID**: CWE-401\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00196\n- **Impact**: Denial of Service (DoS) / Memory Exhaustion\n- **Exploit Status**: None (No public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Go application servers using golang.org/x/crypto/ssh to run SSH server-side services\n- Gitea SSH servers\n- Docker/Podman daemon SSH components\n- HashiCorp Vault SSH secrets engine\n- **golang.org/x/crypto/ssh**: < 0.52.0 (Fixed in: `0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto to version 0.52.0 or higher.\n- Recompile all statically linked Go binaries using the updated library.\n- Implement monitoring for rapid SSH channel creation failures per session.\n\n**Remediation Steps:**\n1. Identify all internal Go projects that utilize the 'golang.org/x/crypto/ssh' package.\n2. Run 'go get golang.org/x/crypto@v0.52.0' in the root directory of the affected projects.\n3. Run 'go mod tidy' to update the dependency tree and lock files.\n4. Rebuild the binaries and redeploy the affected applications.\n\n## References\n\n- [Gerrit Change List 781320](https://go.dev/cl/781320)\n- [Go Review Source Code](https://go-review.googlesource.com/c/crypto/+/781320)\n- [Go GitHub Issue #35127](https://github.com/golang/go/issues/35127)\n- [Go Vulnerability Database Advisory](https://pkg.go.dev/vuln/GO-2026-5016)\n- [CVE-2026-39827 Record](https://www.cve.org/CVERecord?id=CVE-2026-39827)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39827) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T08:22:06.250429Z"} {"uuid": "99df6565-39b6-48ed-8f6b-bff6558faa73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39827", "type": "seen", "source": "https://gist.github.com/alon710/c23e66a189a2d9bd2d0b0916f9459aaf", "content": "# CVE-2026-39827: CVE-2026-39827: Denial of Service via Unbounded Memory Growth in Go SSH (golang.org/x/crypto/ssh)\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39827\n\n## Summary\nAn unbounded memory leak vulnerability in the Go SSH package (golang.org/x/crypto/ssh) allows authenticated users to crash the server by repeatedly requesting connection channels that are rejected, leading to system resource exhaustion.\n\n## TL;DR\nA memory leak in golang.org/x/crypto/ssh prior to version 0.52.0 allows authenticated clients to trigger a Denial of Service by repeatedly sending channel requests that the server rejects.\n\n## Technical Details\n\n- **CWE ID**: CWE-401\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00196\n- **Impact**: Denial of Service (DoS) / Memory Exhaustion\n- **Exploit Status**: None (No public exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Go application servers using golang.org/x/crypto/ssh to run SSH server-side services\n- Gitea SSH servers\n- Docker/Podman daemon SSH components\n- HashiCorp Vault SSH secrets engine\n- **golang.org/x/crypto/ssh**: < 0.52.0 (Fixed in: `0.52.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/crypto to version 0.52.0 or higher.\n- Recompile all statically linked Go binaries using the updated library.\n- Implement monitoring for rapid SSH channel creation failures per session.\n\n**Remediation Steps:**\n1. Identify all internal Go projects that utilize the 'golang.org/x/crypto/ssh' package.\n2. Run 'go get golang.org/x/crypto@v0.52.0' in the root directory of the affected projects.\n3. Run 'go mod tidy' to update the dependency tree and lock files.\n4. Rebuild the binaries and redeploy the affected applications.\n\n## References\n\n- [Gerrit Change List 781320](https://go.dev/cl/781320)\n- [Go Review Source Code](https://go-review.googlesource.com/c/crypto/+/781320)\n- [Go GitHub Issue #35127](https://github.com/golang/go/issues/35127)\n- [Go Vulnerability Database Advisory](https://pkg.go.dev/vuln/GO-2026-5016)\n- [CVE-2026-39827 Record](https://www.cve.org/CVERecord?id=CVE-2026-39827)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39827) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T08:22:06.250429Z"} https://vulnerability.circl.lu/sighting/99df6565-39b6-48ed-8f6b-bff6558faa73/export Fri, 26 Jun 2026 08:22:06 +0000 https://vulnerability.circl.lu/sighting/0aaf4d2d-69f3-4712-a84c-53e59d93b2f3/export {"uuid": "0aaf4d2d-69f3-4712-a84c-53e59d93b2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39829", "type": "seen", "source": "https://gist.github.com/alon710/404c8247b3af526ba72db3d836620396", "content": "# CVE-2026-39829: CVE-2026-39829: Denial of Service in Go SSH Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39829\n\n## Summary\nA high-severity Denial of Service (DoS) vulnerability exists in the golang.org/x/crypto/ssh package prior to version 0.52.0. The vulnerability is caused by a lack of size and range validation on incoming RSA and DSA public key parameters during SSH authentication. An unauthenticated attacker can submit a crafted public key with pathologically large parameters, triggering intensive CPU computation during signature verification and leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust SSH server CPU resources by sending public keys with oversized parameters during the authentication handshake.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1176\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 7.5\n- **EPSS Score**: 0.00304\n- **Exploit Status**: Proof-of-Concept\n- **Affected Module**: golang.org/x/crypto/ssh\n- **Fixed Version**: v0.52.0\n\n## Affected Systems\n\n- Docker\n- containerd\n- HashiCorp Vault\n- Kubernetes Components\n- Gitea\n- Cloudflared\n- **golang.org/x/crypto/ssh**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade the golang.org/x/crypto dependency to v0.52.0 or higher.\n- Recompile all downstream packages to embed the fixed dependency.\n- Limit SSH port access using network-level firewall rules.\n\n**Remediation Steps:**\n1. Open the go.mod file of your project.\n2. Update the golang.org/x/crypto line to reference v0.52.0 or higher.\n3. Run 'go mod tidy' to update the lockfile.\n4. Rebuild your binaries and redeploy them to production environments.\n\n## References\n\n- [Go Issue #79565](https://go.dev/issue/79565)\n- [Golang Announce Security Advisory](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n- [Go Vulnerability Database Entry](https://pkg.go.dev/vuln/GO-2026-5018)\n- [NVD CVE-2026-39829 Record](https://www.cve.org/CVERecord?id=CVE-2026-39829)\n- [Wiz CVE-2026-39829 Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-39829)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39829) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T05:42:25.052371Z"} {"uuid": "0aaf4d2d-69f3-4712-a84c-53e59d93b2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39829", "type": "seen", "source": "https://gist.github.com/alon710/404c8247b3af526ba72db3d836620396", "content": "# CVE-2026-39829: CVE-2026-39829: Denial of Service in Go SSH Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-39829\n\n## Summary\nA high-severity Denial of Service (DoS) vulnerability exists in the golang.org/x/crypto/ssh package prior to version 0.52.0. The vulnerability is caused by a lack of size and range validation on incoming RSA and DSA public key parameters during SSH authentication. An unauthenticated attacker can submit a crafted public key with pathologically large parameters, triggering intensive CPU computation during signature verification and leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust SSH server CPU resources by sending public keys with oversized parameters during the authentication handshake.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1176\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 7.5\n- **EPSS Score**: 0.00304\n- **Exploit Status**: Proof-of-Concept\n- **Affected Module**: golang.org/x/crypto/ssh\n- **Fixed Version**: v0.52.0\n\n## Affected Systems\n\n- Docker\n- containerd\n- HashiCorp Vault\n- Kubernetes Components\n- Gitea\n- Cloudflared\n- **golang.org/x/crypto/ssh**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade the golang.org/x/crypto dependency to v0.52.0 or higher.\n- Recompile all downstream packages to embed the fixed dependency.\n- Limit SSH port access using network-level firewall rules.\n\n**Remediation Steps:**\n1. Open the go.mod file of your project.\n2. Update the golang.org/x/crypto line to reference v0.52.0 or higher.\n3. Run 'go mod tidy' to update the lockfile.\n4. Rebuild your binaries and redeploy them to production environments.\n\n## References\n\n- [Go Issue #79565](https://go.dev/issue/79565)\n- [Golang Announce Security Advisory](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n- [Go Vulnerability Database Entry](https://pkg.go.dev/vuln/GO-2026-5018)\n- [NVD CVE-2026-39829 Record](https://www.cve.org/CVERecord?id=CVE-2026-39829)\n- [Wiz CVE-2026-39829 Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-39829)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-39829) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T05:42:25.052371Z"} https://vulnerability.circl.lu/sighting/0aaf4d2d-69f3-4712-a84c-53e59d93b2f3/export Fri, 26 Jun 2026 05:42:25 +0000 https://vulnerability.circl.lu/sighting/c6114fa0-2343-43af-aa59-510e89d20f98/export {"uuid": "c6114fa0-2343-43af-aa59-510e89d20f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39824", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3moxe4kzo7v2j", "content": "\n\ud83d\udea8 New UNKNOWN CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-39824 impacts golang.org/x/sys in 26 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/574\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-06-23T12:01:33.224975Z"} {"uuid": "c6114fa0-2343-43af-aa59-510e89d20f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39824", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3moxe4kzo7v2j", "content": "\n\ud83d\udea8 New UNKNOWN CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-39824 impacts golang.org/x/sys in 26 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/574\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-06-23T12:01:33.224975Z"} https://vulnerability.circl.lu/sighting/c6114fa0-2343-43af-aa59-510e89d20f98/export Tue, 23 Jun 2026 12:01:33 +0000 https://vulnerability.circl.lu/sighting/6b81c3b5-878c-4557-bf36-afe2f98f5a9d/export {"uuid": "6b81c3b5-878c-4557-bf36-afe2f98f5a9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnafjazque2y", "content": "\ud83d\udd17 CVE : CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466, CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466", "creation_timestamp": "2026-06-01T15:36:36.898919Z"} {"uuid": "6b81c3b5-878c-4557-bf36-afe2f98f5a9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39828", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnafjazque2y", "content": "\ud83d\udd17 CVE : CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466, CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466", "creation_timestamp": "2026-06-01T15:36:36.898919Z"} https://vulnerability.circl.lu/sighting/6b81c3b5-878c-4557-bf36-afe2f98f5a9d/export Mon, 01 Jun 2026 15:36:36 +0000 https://vulnerability.circl.lu/sighting/d8575041-eece-48be-8a4a-bccc0021de1f/export {"uuid": "d8575041-eece-48be-8a4a-bccc0021de1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39827", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnafjazque2y", "content": "\ud83d\udd17 CVE : CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466, CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466", "creation_timestamp": "2026-06-01T15:34:26.714226Z"} {"uuid": "d8575041-eece-48be-8a4a-bccc0021de1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39827", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnafjazque2y", "content": "\ud83d\udd17 CVE : CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466, CVE-2026-25680, CVE-2026-25681, CVE-2026-39827, CVE-2026-39828, CVE-2026-39835, CVE-2026-41401, CVE-2026-42502, CVE-2026-46598, CVE-2026-8466", "creation_timestamp": "2026-06-01T15:34:26.714226Z"} https://vulnerability.circl.lu/sighting/d8575041-eece-48be-8a4a-bccc0021de1f/export Mon, 01 Jun 2026 15:34:26 +0000 https://vulnerability.circl.lu/sighting/0c1938bf-dfae-499c-a0f0-d0d0f1df0ff0/export {"uuid": "0c1938bf-dfae-499c-a0f0-d0d0f1df0ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39821", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmyxucm7rf22", "content": "\ud83d\udccc CVE-2026-39821 - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example... https://www.cyberhub.blog/cves/CVE-2026-39821", "creation_timestamp": "2026-05-29T16:37:06.997131Z"} {"uuid": "0c1938bf-dfae-499c-a0f0-d0d0f1df0ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39821", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmyxucm7rf22", "content": "\ud83d\udccc CVE-2026-39821 - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example... https://www.cyberhub.blog/cves/CVE-2026-39821", "creation_timestamp": "2026-05-29T16:37:06.997131Z"} https://vulnerability.circl.lu/sighting/0c1938bf-dfae-499c-a0f0-d0d0f1df0ff0/export Fri, 29 May 2026 16:37:06 +0000 https://vulnerability.circl.lu/sighting/e3d3665d-7fec-4896-a4d9-1d16ba27d683/export {"uuid": "e3d3665d-7fec-4896-a4d9-1d16ba27d683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39823", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mmyigw37xx2y", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-39823 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/536 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-05-29T12:01:11.850279Z"} {"uuid": "e3d3665d-7fec-4896-a4d9-1d16ba27d683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39823", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mmyigw37xx2y", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-39823 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/536 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-05-29T12:01:11.850279Z"} https://vulnerability.circl.lu/sighting/e3d3665d-7fec-4896-a4d9-1d16ba27d683/export Fri, 29 May 2026 12:01:11 +0000