Vulnerabilities in pkg:golang/golang.org/x/crypto
PACKAGECVE-2026-39830 is a CRITICAL (CVSS 9.1) invoking client can cause server vulnerability (CWE-772: Missing Release of Resource after Effective Lifetime) affecting Golang.org/x/crypto libraries in the Go ecosystem. The issue involves invoking client can cause server deadlock on unexpected responses. Remediation is available by upgrading affected packages to version 0.52.0.
pkg:golang/golang.org/x/crypto
Vulnerability advisories affecting package pkg:golang/golang.org/x/crypto. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-vgwf-h737-ff37 | CVE-2026-39830 | CRITICAL | golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses |
| GHSA-78mq-xcr3-xm33 | CVE-2026-39835 | MODERATE | golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow |
| GHSA-f5wc-c3c7-36mc | CVE-2026-39832 | CRITICAL | golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys |
| GHSA-45gg-vh54-h5m9 | CVE-2026-39828 | MODERATE | golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions |
| GHSA-w879-237q-wc7r | CVE-2026-39829 | HIGH | golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS |
| GHSA-x527-x647-q7gg | CVE-2026-46595 | CRITICAL | golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement |
| GHSA-5cgq-3rg8-m6cv | CVE-2026-42508 | CRITICAL | golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status |
| GHSA-9m57-25v3-79x9 | CVE-2026-46598 | MODERATE | golang.org/x/crypto: Invoking pathological inputs can lead to client panic |
| GHSA-jppx-rxg9-jmrx | CVE-2026-39833 | CRITICAL | golang.org/x/crypto doesn't enforce invoking key constraints |
| GHSA-rm3j-f69w-wqmq | CVE-2026-39834 | CRITICAL | golang.org/x/crypto vulnerable to infinite loop on large channel writes |
| GHSA-89gr-r52h-f8rx | CVE-2026-39831 | CRITICAL | golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed |
| GHSA-qpw4-5x99-6vjp | CVE-2026-39827 | MODERATE | golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS |
| GHSA-q4h4-gmj2-qvw2 | CVE-2026-46597 | HIGH | golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic |
| GHSA-45x7-px36-x8w8 | CVE-2023-48795 | MODERATE | Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin |
| GHSA-f6x5-jh6r-wrfv | CVE-2025-47914 | MODERATE | golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read |
| GHSA-j5w8-q4qc-rx2x | CVE-2025-58181 | MODERATE | golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption |
| GHSA-hcg3-q754-cr77 | CVE-2025-22869 | HIGH | golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange |
| GHSA-v778-237x-gjrc | CVE-2024-45337 | CRITICAL | Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto |
| GHSA-cjjc-xp8v-855w | CVE-2020-7919 | HIGH | Helm uses crypto package vulnerable to panic from malformed X.509 certificate |
| GHSA-xhjq-w7xm-p8qj | CVE-2017-3204 | HIGH | golang.org/x/crypto/ssh Man-in-the-Middle attack |
| GHSA-x3jr-pf6g-c48f | CVE-2019-11841 | MODERATE | Golang/x/crypto message forgery vulnerability |
| GHSA-r5c5-pr8j-pfp7 | CVE-2019-11840 | MODERATE | golang.org/x/crypto/salsa20/salsa uses insufficiently random values |
| GHSA-8c26-wmh5-6g9v | CVE-2022-27191 | HIGH | golang.org/x/crypto/ssh Denial of service via crafted Signer |
| GHSA-gwc9-m7rh-j2ww | CVE-2021-43565 | HIGH | x/crypto/ssh vulnerable to panic via malformed packets |
| GHSA-3vm4-22fp-5rfm | CVE-2020-29652 | HIGH | golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability |
| GHSA-ffhg-7mh4-33c4 | CVE-2020-9283 | HIGH | Improper Verification of Cryptographic Signature in golang.org/x/crypto |
CVE-2026-39830 at a Glance
Security Impact
CVSS: 9.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
How to Fix CVE-2026-39830
To remediate this vulnerability, upgrade all affected Golang.org/x/crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade golang.org/x/crypto to 0.52.0
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for golang.org/x/crypto
How to Check if You Are Affected
To determine whether your application is affected by CVE-2026-39830, inspect your project dependencies for Golang.org/x/crypto:
inspect dependencies for golang.org/x/crypto
Analyze the terminal output to locate any version of Golang.org/x/crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.52.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-772: Missing Release of Resource after Effective Lifetime, where the product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. In Golang.org/x/crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-39830 Affected Golang.org/x/crypto Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
golang.org/x/crypto
|
Go |
< 0.52.0
|
0.52.0
|
References
Frequently Asked Questions
What is CVE-2026-39830?
Which Golang.org/x/crypto versions are affected?
What version fixes CVE-2026-39830?
Is golang.org/x/crypto affected?
What is the CVSS score of CVE-2026-39830?
What CWE is associated with CVE-2026-39830?
How can I check Go dependencies for CVE-2026-39830?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-vgwf-h737-ff37",
"modified" : "2026-09-15T12:31:41Z",
"published" : "2026-06-25T22:18:17Z",
"aliases" : [ "CVE-2026-39830" ],
"summary" : "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses",
"details" : "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "golang.org/x/crypto"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.52.0"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:42796"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:43052"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:43692"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:46885"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:47735"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:48151"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:49944"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:51033"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:52857"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:52910"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:54400"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:54531"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:57194"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:57801"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:59467"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:60520"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:61314"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:65964"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:66022"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:66521"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:67450"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/security/cve/CVE-2026-39830"
}, {
"type" : "WEB",
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
}, {
"type" : "PACKAGE",
"url" : "https://cs.opensource.google/go/x/crypto"
}, {
"type" : "WEB",
"url" : "https://go.dev/cl/781640"
}, {
"type" : "WEB",
"url" : "https://go.dev/cl/781664"
}, {
"type" : "WEB",
"url" : "https://go.dev/issue/79564"
}, {
"type" : "WEB",
"url" : "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2026-5017"
}, {
"type" : "WEB",
"url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:29455"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:35833"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36199"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36207"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36319"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36625"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36648"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36651"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36796"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36797"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:36808"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37072"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37268"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37271"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37272"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37275"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37278"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37286"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37296"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:37387"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40118"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40262"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40945"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40969"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40972"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:40974"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:41019"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:41031"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:41036"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:41066"
}, {
"type" : "WEB",
"url" : "https://access.redhat.com/errata/RHSA-2026:42146"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-119", "CWE-772" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-25T22:18:17Z",
"nvd_published_at" : "2026-05-22T04:16:22Z"
}
}