Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Go crypto library can deadlock server connections

CVE-2026-39830 · published 4 months ago
Summary

The Go cryptography library used by Canonical’s Go, LXD, Snapd, Google Guest Agent and Bellsoft Skopeo can get stuck if an SSH client sends unexpected messages, causing the server to stop responding and waste resources. The problem has been fixed by ignoring those unexpected messages, so updating the listed packages to the latest version will prevent the lock‑up.

What to do
  • Update canonical lxd to version 3.0.3-0ubuntu1~18.04.2+esm3.
  • Update canonical golang-go.crypto to version 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2.
  • Update canonical google-guest-agent to version 20241011.01-0ubuntu1~18.04.0+esm3.
  • Update canonical google-guest-agent to version 20250116.00-0ubuntu1~20.04.0+esm3.
  • Update canonical golang-go.crypto to version 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2.
  • Update canonical golang-go.crypto to version 1:0.19.0-1ubuntu0.1~esm2.
  • Update canonical google-guest-agent to version 20250506.01-0ubuntu1.2.
  • Update canonical google-guest-agent to version 20250506.01-0ubuntu2.1.
  • Update canonical golang-go.crypto to version 1:0.47.0-1ubuntu0.1~esm1.
  • Update x golang.org/x/crypto to version 0.52.0.
  • Update golang.org x to version 0.52.0.
  • Update x rootio-golang.org/x/crypto to version v0.45.0-root.io.1.
  • Update x golang.org/x/crypto to version v0.45.0-aikido.1.
  • Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.8.
  • Update x golang.org/x/crypto to version v0.31.0-aikido.8.
  • Update x rootio-golang.org/x/crypto to version v0.35.0-root.io.3.
  • Update x golang.org/x/crypto to version v0.35.0-aikido.3.
  • Update x rootio-golang.org/x/crypto to version v0.46.0-root.io.2.
  • Update x golang.org/x/crypto to version v0.46.0-aikido.2.
  • Update canonical golang-go.crypto to version 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2.
  • Update canonical lxd to version 2.0.11-0ubuntu1~16.04.4+esm3.
  • Update canonical google-guest-agent to version 20240716.00-0ubuntu1~16.04.0+esm3.
  • Update canonical google-guest-agent to version 20250116.00-0ubuntu1~22.04.3.
  • Update canonical golang-go.crypto to version 1:0.0~git20211202.5770296-1ubuntu0.1~esm2.
  • Update canonical google-guest-agent to version 20250116.00-0ubuntu1~24.04.4.
  • Update bellsoft podman to version 5.8.4-r0.
  • Update debian golang-go.crypto to version 1:0.52.0-1.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.3.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.3.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.5.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.5.
  • Update x golang.org/x/crypto to version v0.32.0-aikido.4.
  • Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.4.
  • Update x golang.org/x/crypto to version v0.31.0-aikido.9.
  • Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.9.
  • Update golang crypto to version 0.52.0 or later.
  • Update golang.org/x/crypto golang.org/x/crypto/ssh to version 0.52.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:16.04:LTS canonical golang-go.crypto < 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2
Fix: upgrade to 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2
Ubuntu:Pro:16.04:LTS canonical lxd < 2.0.11-0ubuntu1~16.04.4+esm3
Fix: upgrade to 2.0.11-0ubuntu1~16.04.4+esm3
Ubuntu:Pro:16.04:LTS canonical snapd All versions
Ubuntu:Pro:18.04:LTS canonical lxd < 3.0.3-0ubuntu1~18.04.2+esm3
Fix: upgrade to 3.0.3-0ubuntu1~18.04.2+esm3
Ubuntu:Pro:18.04:LTS canonical golang-go.crypto < 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2
Fix: upgrade to 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2
Ubuntu:Pro:18.04:LTS canonical google-guest-agent < 20241011.01-0ubuntu1~18.04.0+esm3
Fix: upgrade to 20241011.01-0ubuntu1~18.04.0+esm3
Ubuntu:Pro:20.04:LTS canonical google-guest-agent < 20250116.00-0ubuntu1~20.04.0+esm3
Fix: upgrade to 20250116.00-0ubuntu1~20.04.0+esm3
Ubuntu:Pro:20.04:LTS canonical golang-go.crypto < 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
Fix: upgrade to 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
Ubuntu:Pro:24.04:LTS canonical golang-go.crypto < 1:0.19.0-1ubuntu0.1~esm2
Fix: upgrade to 1:0.19.0-1ubuntu0.1~esm2
Ubuntu:25.10 canonical google-guest-agent < 20250506.01-0ubuntu1.2
Fix: upgrade to 20250506.01-0ubuntu1.2
Ubuntu:26.04:LTS canonical google-guest-agent < 20250506.01-0ubuntu2.1
Fix: upgrade to 20250506.01-0ubuntu2.1
Ubuntu:Pro:26.04:LTS canonical golang-go.crypto < 1:0.47.0-1ubuntu0.1~esm1
Fix: upgrade to 1:0.47.0-1ubuntu0.1~esm1
Alpaquita:23 bellsoft skopeo >= 1.10.0-r2
Alpaquita:25 bellsoft buildah >= 1.40.0-r0
Alpaquita:25 bellsoft containerd >= 2.1.1-r0
Alpaquita:25 bellsoft docker-cli-buildx >= 0.24.0-r0
Alpaquita:25 bellsoft google-guest-agent >= 20250521.00-r0
Alpaquita:25 bellsoft osv-scanner >= 2.1.0-r4
Alpaquita:25 bellsoft podman >= 5.5.0-r0
Alpaquita:25 bellsoft skopeo >= 1.18.0-r2
Alpaquita:stream bellsoft buildah >= 1.31.0-r0
Alpaquita:stream bellsoft calicoctl >= 3.31.3-r0
Alpaquita:stream bellsoft cilium-cli >= 0.19.0-r12
Alpaquita:stream bellsoft containerd >= 1.7.2-r1
Alpaquita:stream bellsoft docker-cli-buildx >= 0.11.0-r0
Alpaquita:stream bellsoft etcd >= 3.6.4-r6
Alpaquita:stream bellsoft google-guest-agent >= 20250214.01-r0
Alpaquita:stream bellsoft grype >= 0.100.0-r0
Alpaquita:stream bellsoft helm >= 3.19.0-r4
Alpaquita:stream bellsoft osv-scanner >= 2.1.0-r2
Go x golang.org/x/crypto < 0.52.0
Fix: upgrade to 0.52.0
Debian:11 debian golang-go.crypto All versions
Debian:12 debian golang-go.crypto All versions
Debian:13 debian golang-go.crypto All versions
Debian:14 debian golang-go.crypto < 1:0.52.0-1
Fix: upgrade to 1:0.52.0-1
Ubuntu:Pro:16.04:LTS canonical google-guest-agent < 20240716.00-0ubuntu1~16.04.0+esm3
Fix: upgrade to 20240716.00-0ubuntu1~16.04.0+esm3
Ubuntu:Pro:18.04:LTS canonical snapd All versions
Ubuntu:Pro:20.04:LTS canonical snapd All versions
Ubuntu:22.04:LTS canonical google-guest-agent < 20250116.00-0ubuntu1~22.04.3
Fix: upgrade to 20250116.00-0ubuntu1~22.04.3
Ubuntu:22.04:LTS canonical snapd All versions
Ubuntu:Pro:22.04:LTS canonical golang-go.crypto < 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
Fix: upgrade to 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
Ubuntu:24.04:LTS canonical google-guest-agent < 20250116.00-0ubuntu1~24.04.4
Fix: upgrade to 20250116.00-0ubuntu1~24.04.4
Ubuntu:24.04:LTS canonical snapd All versions
Ubuntu:25.10 canonical golang-go.crypto All versions
Ubuntu:25.10 canonical snapd All versions
Ubuntu:26.04:LTS canonical golang-go.crypto All versions
Ubuntu:26.04:LTS canonical snapd All versions
– golang crypto < 0.52.0
cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*
go golang.org x < 0.52.0
Fix: upgrade to 0.52.0
Root:Go x rootio-golang.org/x/crypto < v0.45.0-root.io.1
< v0.31.0-root.io.8
< v0.35.0-root.io.3
< v0.46.0-root.io.2
< v0.32.0-root.io.3
< v0.32.0-root.io.5
< v0.32.0-root.io.4
< v0.31.0-root.io.9
Fix: upgrade to v0.45.0-root.io.1
Showing 50 of 57. Show the rest
Ecosystem VendorProductAffected versions
Root:Go x golang.org/x/crypto < v0.45.0-aikido.1
< v0.31.0-aikido.8
< v0.35.0-aikido.3
< v0.46.0-aikido.2
< v0.32.0-aikido.3
< v0.32.0-aikido.5
< v0.32.0-aikido.4
< v0.31.0-aikido.9
Fix: upgrade to v0.45.0-aikido.1
– golang.org/x/crypto golang.org/x/crypto/ssh < 0.52.0
Alpaquita:23 bellsoft buildah >= 1.28.0-r1
Alpaquita:23 bellsoft containerd >= 1.6.10-r0
Alpaquita:23 bellsoft podman >= 4.3.1-r0
Alpaquita:stream bellsoft podman >= 4.5.1-r1, < 5.8.4-r0
Fix: upgrade to 5.8.4-r0
Alpaquita:stream bellsoft skopeo >= 1.13.0-r1
Original advisory text
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-772Missing Release of Resource after Effective Lifetime
CWE-833Deadlock
Timeline
Published22 May 2026
Updated11 Oct 2026
First seen22 May 2026
Sources
DEBIAN-CVE-2026-39830 · OSV
UBUNTU-CVE-2026-39830 · OSV
ROOT-APP-GOBINARY-CVE-2026-39830 · OSV
BELL-CVE-2026-39830 · OSV
GO-2026-5017 · OSV
CVE-2026-39830 · NVD
GHSA-vgwf-h737-ff37 · GHSA
CVE-2026-39830 · MITRE
CVE-2026-39830 · OSV
GHSA-vgwf-h737-ff37 · OSV
Track software like this
Free during beta