CVE-2026-39835 is a NULL pointer dereference vulnerability (CWE-476) in golang.org/x/crypto/ssh. It occurs when SSH servers use CertChecker as a public key callback without explicitly setting the IsUserAuthority or IsHostAuthority callbacks. An unauthenticated remote attacker can exploit this by presenting a specially crafted SSH certificate, causing the server to panic and crash, resulting in a denial of service. The vulnerability requires a specific, non-default CertChecker configuration. Red Hat's advisory confirms the issue and notes that no current mitigation fully meets their criteria. The vulnerability has a CVSS v3.1 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and an availability impact classified as low by cve.org but high by Red Hat.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the SSH server through a crafted certificate. This results in service disruption but does not impact confidentiality or integrity. Exploitation requires a specific CertChecker configuration that is not the default, limiting the scope of affected deployments.

Currently, no mitigation is available that meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor vendor advisories for updates and apply patches when they become available. Red Hat is working on fixes and will release updates in affected products such as Red Hat Edge Manager. Until then, avoid using CertChecker without explicitly setting IsUserAuthority or IsHostAuthority callbacks if possible.