This vulnerability involves an integer overflow (CWE-190) in the golang.org/x/crypto/ssh package when handling Write calls with data sizes exceeding 4GB. The internal calculation of payload size uses an integer type that overflows, causing the write loop to enter an infinite loop sending empty packets. The problem is addressed by switching the size comparison to use a 64-bit integer type (int64), which can correctly represent large payload sizes and prevent overflow.

The integer overflow causes the write operation to spin indefinitely without making progress, effectively resulting in a denial of service condition on the SSH channel. There is no indication of code execution or data corruption beyond the denial of service behavior. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor golang.org/x/crypto project advisories for updates. Until a fix is available, avoid writing data larger than 4GB in a single Write call on SSH channels to prevent triggering the issue.