A malicious SSH peer can send unsolicited global request responses that overflow an internal buffer, blocking the SSH connection’s read loop. The blocked goroutine cannot be released by calling Close(), resulting in a resource leak per connection. The library now discards unsolicited global responses, mitigating the denial of service but the root issue remains if a patch is not applied.

Any application that imports and uses the golang.org/x/crypto/ssh library is potentially affected. No specific version information is available; the vulnerability applies to all versions prior to the fix, and the patch will be included in a forthcoming release of the library.

The vulnerability is exploitable over the network by a remote SSH client. Because the attacker can send large numbers of global request responses, the exhausted buffer causes the server to deadlock and exhaust resources, effectively denying service to legitimate users. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is not provided, but the impact and confirmation of exploitation in the description indicate a high severity. The attack vector is likely remote SSH traffic, and the fix now discards unsolicited responses, but until the updated library is deployed the risk remains.