The vulnerability in golang.org/x/crypto/ssh arises from the lack of enforcement of size limits on RSA and DSA public key parameters. Specifically, the RSA moduli and DSA parameters can be excessively large, which leads to inefficient CPU computation during signature verification. This can be triggered by unauthenticated clients during public key authentication, resulting in a denial of service due to prolonged CPU consumption. The issue is tracked as CVE-2026-39829 and is associated with CWE-1176 (Inefficient Computation) and CWE-1284 (Improper Validation of Specified Quantity in Input). Red Hat's advisory rates this vulnerability as Important and notes no current mitigation or fix that meets their deployment and stability criteria. The vulnerability affects golang.org/x/crypto/ssh as used in various Red Hat products including Red Hat Edge Manager. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

An unauthenticated remote attacker can cause a denial of service on servers using the vulnerable golang.org/x/crypto/ssh component by sending a specially crafted public key with excessively large parameters during SSH public key authentication. This leads to prolonged CPU consumption during signature verification, degrading service availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Currently, there is no official fix or mitigation available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor vendor advisories for updates and consider upgrading to fixed versions once available. Red Hat customers with Technical Account Managers can consult them for guidance. No workaround or configuration change is documented as effective at this time.