An authenticated SSH client that repeatedly opens channels that the server rejects triggers an unbounded memory leak. The library fails to remove rejected channel metadata, allowing memory usage to grow until the SSH server process crashes, resulting in a denial of service for all connected users. This flaw is a classic memory allocation bug and falls under a resource exhaustion weakness (CWE‑924).

Impact applies to the golang.org/x/crypto/ssh library provided by the Go project. No specific vulnerable versions are listed, so any deployment that relies on this library without the fix is at risk. The fix removes rejected channels from the connection state and relies on garbage collection to reclaim memory.

An attacker must first authenticate to the SSH server to send channel requests; repeated authenticated channel attempts can exploit the leak. Because the vulnerability can be triggered by an ordinary SSH client, the practical difficulty is low, and the potential impact is medium, leading to a moderate denial of service. The CVSS score of 6.5 indicates medium severity. The vulnerability is not listed in CISA’s KEV catalog and the EPSS score is < 1%, but the lack of mitigation in older releases makes the risk significant if the library is in use. The weakness is classified as CWE‑924, a resource exhaustion issue.