The vulnerability in golang.org/x/crypto/ssh (CVE-2026-39830) allows a malicious SSH peer to send unsolicited global request responses that fill an internal buffer, blocking the connection's read loop goroutine. This blocked goroutine cannot be released by calling Close(), resulting in a resource leak for each affected connection. The consequence is a denial of service due to resource exhaustion. The flaw is categorized under CWE-833 (Deadlock) and CWE-772 (Missing Release of Resource after Effective Lifetime). The vulnerability is exploitable remotely without authentication and has a CVSS v3.1 score of 9.1 (critical). Vendor advisories, including Red Hat, confirm the impact and recommend network access restrictions as mitigation. No official patch or fix version is explicitly stated in the advisory, but network-level mitigations are advised.

An unauthenticated remote attacker can cause a denial of service by exhausting resources on the affected system through unsolicited global request responses in SSH connections. This leads to blocked goroutines that cannot be released, resulting in resource leaks and potential service disruption for systems using the vulnerable golang.org/x/crypto/ssh library.

The vendor advisory recommends restricting network access to any service utilizing the golang.org/x/crypto/ssh library exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. Restarting the affected service may be necessary for the new network rules to take effect. No official patch or fix version is explicitly confirmed in the advisory; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.