Search: CVE-2026-39834

CVE-2026-39834 is a critical integer overflow vulnerability in the golang.org/x/crypto/ssh package. It occurs when writing data larger than 4GB in a single Write call on an SSH channel, causing an integer overflow in the internal payload size calculation. This overflow results in an infinite loop that sends empty packets without progress, leading to a denial of service condition. The issue stems from using a truncated integer type for size comparison, which has been addressed by switching to int64 to prevent overflow.