A malicious peer can send a flood of channel open requests to a Go SSH server before the channel is officially established. The library's channel multiplexing structure queues these requests and, without any guard, can become deadlocked, causing the entire SSH connection to become unresponsive and effectively denying service. This flaw does not enable arbitrary code execution but can halt SSH sessions and affect any client attempting to use the affected channel.

Any installation that uses the golang.org/x/crypto/ssh package and its channel multiplexer before the fix is affected; version information is not specified, so all uses prior to the updated release are potentially vulnerable.

The vulnerability is exploitable over the network by an attacker who can establish an SSH session and send repeated channel requests. No login credentials or privileged access are required. The EPSS score is less than 1% and the issue is not listed in CISA KEV, so the quantified risk is unknown, but remote denial of service is possible. The CVSS score is 7.5, indicating a high severity vulnerability. The fix adds an atomic established state and drops packets until the channel is usable, thereby preventing the deadlock.