The vulnerability is triggered when a malicious SSH peer sends specially crafted channel messages after a SSH session has been established. The golang.org/x/crypto/ssh library would block on an internal lock, causing the entire connection to stall. The resulting denial of service prevents any further SSH operations until the deadlock is resolved. The fix changes the handling of all RFC 4254 channel messages so that unknown or malformed messages are treated as protocol errors, causing the connection to be dropped instead of buffering and blocking, thereby eliminating the deadlock scenario.

The affected component is the golang.org/x/crypto/ssh package used in Go applications that establish SSH channels. Any program that imports this library can be impacted. No specific version ranges are listed, so users should verify that they are using the latest release of the library.

The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to control a peer that can send crafted channel data after the session handshake. Because the corrected code now aborts the connection on protocol errors, the exploitation path still exists that can trigger a premature disconnect or a DoS. The potential impact remains high for services that rely on continuous SSH connectivity, while the likelihood of successful exploitation is limited to situations where the attacker can send messages before the deadlock would have otherwise developed. The CVSS score of 7.5 indicates a high severity, underscoring the need for timely patching.