This vulnerability involves a deadlock condition in the golang.org/x/crypto/ssh package. Specifically, a malicious SSH peer can send unsolicited global request responses that fill an internal buffer, blocking the read loop goroutine. Because the goroutine remains blocked and cannot be released by calling Close(), this results in a resource leak for each affected connection. The fix involves discarding unsolicited global responses to prevent the buffer from filling and the deadlock from occurring.

The vulnerability causes a resource leak due to a deadlock in the SSH connection handling code. This can degrade service availability or lead to denial of service conditions by exhausting resources on the server handling SSH connections. There is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated that unsolicited global responses are now discarded, which suggests a fix or mitigation is implemented. Users should verify they are using a version of golang.org/x/crypto/ssh that includes this change or apply any official patches once available.