CVE-2026-78662: CWE-770: Allocation of Resources Without Limits or Throttling in golang.org/x/crypto golang.org/x/crypto/ssh

CVE-2026-78662 is a resource exhaustion vulnerability (CWE-770) in the golang.org/x/crypto/ssh package. A malicious peer can flood requests on a channel before it is fully established, leading to a deadlock of the entire SSH connection. This occurs because channels are registered in the mux's chanList but are not usable until established, allowing unlimited resource allocation without throttling. The fix involves introducing an atomic established state that drops packets other than open confirmation or failure until the channel becomes usable, thereby preventing blocking or connection teardown.

The vulnerability can cause a denial of service by deadlocking the entire SSH connection when a malicious peer floods requests on a channel before it is fully established. This impacts availability but does not affect confidentiality or integrity. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding an atomic established state to drop packets until the channel is usable, which prevents the deadlock. Users should monitor the golang.org/x/crypto project for an official fix and apply it once available.