PatchTheCVECVE-2026-39834: When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the interna
CVE-2026-39834 is a critical-severity flaw (CVSS 9.1) affecting crypto. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 52%) |
| CISA exploited list | No |
| Weakness | CWE-190 |
| Published | 2026-05-22 |
| Last modified | 2026-07-23 |
Last updated 2026-07-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-39834?
crypto: upgrade to 0.52.0. Exact commands for each OS are on this page.
Is CVE-2026-39834 being exploited?
CVE-2026-39834 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-39834 affect?
CVE-2026-39834 affects crypto. Severity is critical (CVSS 9.1). When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size com
How urgent is CVE-2026-39834?
Priority 49/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-39835 MEDIUM 5.3 UPGRADE SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority
- CVE-2026-39830 CRITICAL 9.1 UPGRADE A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the
- CVE-2026-39829 HIGH 7.5 UPGRADE The RSA and DSA public key parsers did not enforce size limits on key parameters
- CVE-2026-42508 CRITICAL 9.1 UPGRADE Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
- CVE-2026-39832 CRITICAL 9.1 UPGRADE When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were no