{"id":"CVE-2026-78662","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-78662","summary":"Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh","details":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","published":"2026-09-02T19:12:04Z","modified":"2026-09-03T10:10:55.147673102Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"golang.org/x/crypto","fixedVersion":"0.56.0"}],"fix":null,"references":[{"type":"REPORT","url":"https://go.dev/issue/81316"},{"type":"FIX","url":"https://go.dev/cl/826504"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/1y3fb2np35U"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-03T10:10:55.147673102Z"}}