CVE-2026-78662
Received Received - Intake

Atomic Channel State Fix in Go

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Go Project

Description
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-03
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78662
EUVD
EUVD-2026-70266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
golang go to v0.56.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service (DoS) issue in the golang.org/x/crypto/ssh package before version v0.56.0. A malicious peer can flood a channel's incomingRequests, causing a deadlock that blocks the entire SSH connection. The fix introduces an atomic state to track when a channel becomes usable, dropping packets except open confirmations or failures until then.

Detection Guidance

This vulnerability affects the golang.org/x/crypto/ssh package before version v0.56.0. To detect it, check the version of the package in use with commands like 'go list -m golang.org/x/crypto/ssh' or 'go version -m <your-binary>'. If the version is below v0.56.0, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could cause SSH connections to hang or become unresponsive, leading to service disruptions. Systems relying on SSH for secure communication may experience downtime or require manual intervention to restore functionality.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a technical DoS issue in the Go SSH package. Compliance impacts would only occur if the DoS disrupts systems handling regulated data.

Mitigation Strategies

Upgrade the golang.org/x/crypto/ssh package to version v0.56.0 or later using 'go get golang.org/x/crypto/ssh@latest'. Ensure all applications using this package are rebuilt and redeployed after the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart