A malicious SSH peer can send unsolicited global request responses that fill an internal buffer in the golang.org/x/crypto/ssh library. The excessive data blocks the read loop and the goroutine handling the connection cannot be terminated by calling Close(), resulting in a resource leak for each affected session. The vulnerability therefore introduces a denial‑of‑service condition by exhausting server resources and potentially causing an application to become unresponsive.

Any application that imports golang.org/x/crypto/ssh and is running a pre‑patch version is potentially vulnerable. The CNA data does not specify a version range, indicating that all earlier releases prior to the fix that discards unsolicited responses are at risk.

The CVSS score of 9.1 marks this as a critical issue, while the EPSS score below 1% and lack of listing in the CISA KEV catalog suggest a low exploitation probability at present. The exploit requires a remote SSH client with network access to the target and the ability to construct crafted global request responses. Once triggered, the deep buffer usage and goroutine deadlock can lead to sustained resource exhaustion and service disruption.