The vulnerability in golang.org/x/crypto/ssh (CVE-2026-39830) involves a deadlock caused by unsolicited global request responses from a malicious SSH peer. These responses fill an internal buffer and block the connection's read loop goroutine. The blocked goroutine cannot be released by calling Close(), leading to a resource leak for each affected connection. The fix involves discarding unsolicited global responses to prevent the buffer from filling and the deadlock from occurring. This vulnerability has a CVSS score of 9.1 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability.

An attacker who can act as a malicious SSH peer can cause a denial of service by sending unsolicited global request responses that fill an internal buffer, blocking the read loop goroutine. This results in a resource leak per connection, potentially exhausting resources and disrupting service availability. Confidentiality impact is rated high due to the CVSS vector, but the description primarily indicates denial of service via resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory references this vulnerability and indicates it is addressed by discarding unsolicited global responses. Users should monitor the linked Red Hat advisories for official patches or updates. Until a patch is applied, mitigating exposure to untrusted SSH peers or limiting SSH connections to trusted sources may reduce risk.