CVE-2026-39835 golang.org/x/crypto CVE debrief

Who should care

Defenders responsible for SSH servers using the affected golang.org/x/crypto/ssh package should assess exposure and prioritize patching, particularly in environments where untrusted clients may connect.

Why it matters

CVE-2026-39835 is a medium-severity vulnerability affecting the golang.org/x/crypto/ssh package, allowing a client to cause a panic by presenting a certificate. Defenders should prioritize verifying and applying patches, reviewing SSH server configurations, and monitoring for potential exploitation attempts.

• Potential denial of service due to panic
• Need to verify and apply patches for the affected package
• Importance of reviewing SSH server configurations

Technical summary

The golang.org/x/crypto/ssh package is vulnerable to a panic caused by a client presenting a certificate when the server uses CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority. The CertChecker now returns an error instead of panicking when these callbacks are nil. This vulnerability affects SSH servers using the affected package, particularly in environments where untrusted clients may connect. Defenders should prioritize verifying and applying patches for the affected package. Reviewing SSH server configurations to ensure IsUserAuthority or IsHostAuthority is set can help mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and applying patches for the affected golang.org/x/crypto/ssh package, particularly in environments where untrusted clients may connect to SSH servers.

Recommended defensive actions

• Verify and apply patches for the affected golang.org/x/crypto/ssh package
• Review SSH server configurations to ensure IsUserAuthority or IsHostAuthority is set
• Monitor for and respond to potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories and errata from Red Hat are also available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.