VDB
RHSA-2026:54400
RHSA-2026:54400
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/volsync-rhel9@sha256:e7287730240e2f291f9a288b1c6303cf316ba486996b9c0c86994a8b65207e32_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| golang.org | x/crypto | |
| Red Hat | registry.redhat.io/rhacm2/volsync-operator-bundle@sha256:29848647ba1965c23a770975538c66974406466a4d4c64c930d2ac911b5bd93f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/volsync-rhel9@sha256:8cc7331a2b17bd12746e860d38443f43e95ec77a8ce6bedb892f6e9ae57adf39_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/volsync-rhel9@sha256:ebe5b27219964ba01299499baa1a5d237c976018df7c370ddacc7b0c53ccb6d0_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/volsync-rhel9@sha256:c3f585f0b53eaa91b6d615b3fdbb001f65117f7685e438652b2d2f7d6a1759a7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| golang | x/crypto/ssh |
Timeline
- Aug 12, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54400 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-42508 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54400.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480681 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39829 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39829 advisory
- https://go.dev/cl/781641 advisory
- https://go.dev/cl/781661 advisory
- https://go.dev/issue/79565 advisory
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI advisory
- https://pkg.go.dev/vuln/GO-2026-5018 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480684 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39830 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39830 advisory
- https://go.dev/cl/781640 advisory
…and 21 more