VulnSocial

CVE-2026-78662Patch(golang / crypto)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch golang crypto systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

golang CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • crypto

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 3 signals
  • Peaked 1d ago at 2 mentions (2026-09-09); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
golang
Products
crypto

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-04: 1Mentions · 2026-09-09: 2Mentions · 2026-10-02: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-09: 2Patch / Workaround · 2026-10-02: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-09: 1Technical Details · 2026-10-02: 109-0409-0910-02
Signal classification1 categories
Patch
4100.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-041
Patch1
2026-09-092
Patch2
2026-10-021
Patch1
Full discourse4 posts
  • Repojournal@repojournal
    Patch

    Kubernetes patches CVE-2026-78662, an SSH denial of service, by bumping golang․org/x/crypto to v0.56.0. Debian 11 bullseye hit end of LTS on 2026-08-31, and that broke every kube-cross build variant since they all build on debian:bullseye-slim. The release repo pins apt sources to snapshot․debian․org to keep images building. cluster-autoscaler fixes the Scaleway provider overriding taints with the same key/value but different effects. A new API field returns the correct taint list. kubernetes/api drops go-json-experiment with a kube-openapi bump, and cloud-provider-openstack adds ServiceMonitor regression coverage for the OCCM Helm chart, exercising both enabled and disabled paths. #kubernetes https://repojournal.com/showcase/kubernetes/2026-09-09/kubernetes-patches-ssh-dos-cve-fixes-kube-cross-bullseye-build-break

    Post summary

    The post announces that Kubernetes has patched CVE-2026-78662, an SSH denial‑of‑service vulnerability, by upgrading golang.org/x/crypto to v0.56.0.

    0305065
    452 followersView on X
  • Repojournal@repojournal
    Patch

    kubernetes/kubernetes merges a fix for CVE-2026-78662 by bumping golang․org/x/crypto to v0.56.0. The PR title says fix, so that's the lead. kubernetes/release moves build images ahead: kube-cross, go-runner, and releng-ci now build with golang 1.27.1 and 1.26.8. Old k8s version images get deprecated. Two pre-existing CI breakages on master were also cleared to unblock this. kubernetes/kubernetes also bumps kube-openapi and drops go-json-experiment. Less dramatic, but fewer dependencies in the tree is its own kind of quiet. openstack-cloud-controller-manager ships a Helm chart at 2.36.5, and the autoscaler fixes an int32 overflow when computing memory from AWS InstanceRequirements. A day of patched crypto and cleaned-up builds. #kubernetes https://repojournal.com/showcase/kubernetes/2026-09-09/kubernetes-patches-ssh-dos-cve-fixes-kube-cross-bullseye-build-break

    Post summary

    Kubernetes patches CVE-2026-78662 by bumping golang dependencies, with other build-related updates; no active exploitation, PoC, or exploit code is mentioned.

    0304060
    452 followersView on X
  • David Duong@DDuongTech
    Patch

    OpenTofu 1.12.7 fixes an SSH provisioner deadlock affecting remote-exec/file against attacker-controlled servers (CVE-2026-78662, CVE-2026-56855). https://github.com/opentofu/opentofu/releases/tag

    Post summary

    OpenTofu 1.12.7 fixes CVE-2026-78662 and CVE-2026-56855, an SSH provisioner deadlock affecting remote-exec/file against attacker-controlled servers, with a GitHub release link provided; no PoC, exploit tool, or active exploitation is mentioned.

    0002062
    174 followersView on X
  • theenmusketeers@theenmusketeers
    Patch

    new ssh DoS fixes in http://golang.org/x/crypto v0.56.0: CVE-2026-56855 and CVE-2026-78662. a peer can send crafted channel messages and deadlock your entire connection. if you run go ssh servers: 1. go get http://golang.org/x/crypto@v0.56.0 2. go mod tidy - x/crypto sneaks in as an indirect dep half the time 3. govulncheck to see if the ssh code is even reachable in your binary both reported by the same person. one crafted message away from a deadlocked server, and the fix is a one-liner.

    Post summary

    The post announces that CVE‑2026‑56855 and CVE‑2026‑78662 are fixed in golang.org/x/crypto v0.56.0, detailing how to upgrade to apply the one‑liner patch.

    0000044
    234 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgolangcrypto-go-

Explore more

Back to dashboardgolang CVEscrypto vulnerabilities