Executive brief
A vulnerability in the Go SSH library can cause applications to enter an infinite loop when attempting to send large amounts of data (over 4GB) at once. This results in the application becoming unresponsive and consuming excessive system resources while failing to transmit the intended data. Organizations using Go-based SSH services or clients should update to prevent potential denial-of-service conditions.
Technical details
An integer overflow exists in the internal payload size calculation of the golang.org/x/crypto/ssh package. When a single Write call on an SSH channel exceeds 4GB, the internal size comparison truncates the value, causing the write loop to spin indefinitely. During this state, the library sends empty packets without making progress, leading to a denial-of-service (DoS) condition. The vulnerability is triggered remotely if an attacker can influence the size of data being written to an SSH channel. The issue was resolved in version 0.52.0 by using int64 for size comparisons to prevent truncation.
Affected products
- Go Project golang.org/x/crypto/ssh < 0.52.0
Timeline
- 2026-05-21: disclosed: Reported by NCC Group Cryptography Services
- 2026-05-22: advisory: NVD and Go Project published initial advisories
- 2026-06-25: advisory: GitHub Advisory published