This vulnerability in golang.org/x/crypto/ssh arises from an integer overflow when handling Write calls exceeding 4GB. The internal payload size calculation uses a truncated integer type that overflows, causing an infinite loop sending empty packets and resulting in denial of service. The root cause is the use of an insufficient integer size for payload length calculations. The fix involves changing the integer type to int64 to handle larger payload sizes safely.

An attacker or user writing data larger than 4GB in a single Write call on an SSH channel can trigger an integer overflow that causes the SSH channel to enter an infinite loop sending empty packets. This leads to a denial of service by preventing further progress on the channel. There is no confidentiality or integrity impact reported, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid sending Write calls larger than 4GB on SSH channels using the affected package version. Monitor for vendor updates addressing this integer overflow vulnerability.