The vulnerability in golang.org/x/crypto/ssh involves the RSA and DSA public key parsers lacking enforcement of size limits on key parameters. An attacker can supply a crafted public key with an excessively large modulus or DSA parameter, causing the signature verification process to consume several minutes of CPU time, resulting in a denial of service. This can be exploited by unauthenticated clients during public key authentication. The fix involves limiting RSA moduli to 8192 bits and validating DSA parameters per FIPS 186-2 standards. Red Hat has released security advisories and updates to address this vulnerability in affected products including Red Hat Edge Manager.

The vulnerability allows unauthenticated attackers to cause a denial of service by sending crafted public keys with excessively large parameters, which leads to inefficient CPU computation and prolonged resource consumption during signature verification. This can degrade or disrupt services relying on golang.org/x/crypto/ssh for authentication.

Red Hat has issued security advisories and updates that address this vulnerability. Users of affected Red Hat products should apply the provided security updates as per Red Hat's guidance. Since no official fix or patch is explicitly stated in the provided data beyond these advisories, users should consult the Red Hat advisories at https://access.redhat.com/security/cve/CVE-2026-39829 and https://access.redhat.com/errata/RHSA-2026:29455 for detailed remediation instructions and to confirm patch availability.