CVE-2026-39829: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-39829 is a denial-of-service vulnerability in the golang.org/x/crypto/ssh package where RSA and DSA public key parsers fail to enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter can cause several minutes of CPU consumption during signature verification, triggerable by unauthenticated clients during public key authentication. The vulnerability affects golang.org/x/crypto versions prior to 0.52.0 and was published on May 22, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Go Vuln DB).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature) — specifically, the SSH public key parsers in golang.org/x/crypto/ssh accepted arbitrarily large RSA moduli and DSA parameters without validation, leading to pathological computation time during signature verification. An unauthenticated attacker can submit a crafted RSA or DSA public key with an oversized parameter during the SSH public key authentication handshake, triggering excessive CPU consumption on the server side without completing authentication. The fix limits RSA moduli to 8192 bits and validates DSA parameters per FIPS 186-2. Relevant upstream changes are tracked in Go issues and code reviews (Go Issue, Go CL 781641, Go CL 781661).

Successful exploitation causes a denial-of-service condition on any service using the affected golang.org/x/crypto/ssh package for public key authentication, as each malicious key submission can consume several minutes of CPU time. Because the attack requires no authentication or user interaction, a single attacker or botnet can repeatedly submit crafted keys to exhaust server CPU resources, potentially rendering the SSH service unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Go Vuln DB).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.034%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the low exploitation evidence, the attack is trivially executable by any unauthenticated network attacker with access to an SSH endpoint using the affected library, making it a meaningful risk for exposed services.

1. Reconnaissance: Identify services exposing SSH endpoints that are built with Go and use golang.org/x/crypto/ssh versions prior to 0.52.0 (e.g., via banner grabbing or version disclosure).
2. Craft malicious public key: Generate an RSA public key with an excessively large modulus (e.g., far exceeding 8192 bits) or a DSA public key with oversized parameters that do not conform to FIPS 186-2.
3. Initiate SSH public key authentication: Connect to the target SSH service and submit the crafted public key as part of the authentication handshake — no valid credentials are required to trigger the parsing step.
4. Trigger CPU exhaustion: The server's key parser attempts to process the oversized parameters during signature verification, consuming several minutes of CPU time per request.
5. Repeat for sustained DoS: Submit multiple crafted keys in parallel or in rapid succession to sustain CPU exhaustion and deny service to legitimate users (Go Issue, Go Vuln DB).

• Network: Repeated inbound SSH connection attempts (TCP port 22 or custom SSH port) that do not complete authentication, originating from one or few source IPs; unusually high volume of SSH publickey authentication method attempts.
• Logs: SSH server logs showing repeated publickey authentication attempts with no successful logins; Go application logs indicating slow or stalled key parsing operations.
• Process: Sustained high CPU utilization on the SSH service process (Go binary) without corresponding legitimate user activity; CPU spikes correlated with inbound SSH connection bursts.

Update golang.org/x/crypto to version 0.52.0 or later, which enforces RSA moduli limits of 8192 bits and validates DSA parameters per FIPS 186-2 (Go Vuln DB). As interim mitigations, implement network-level rate limiting on SSH authentication attempts to reduce exposure to malicious key submissions, and consider firewall rules to restrict SSH access to trusted IP ranges. Downstream projects such as HashiCorp Vault (v2.0.2), rclone, and Pulumi Kubernetes provider have already released updates incorporating the patched library.

The Go security team disclosed the vulnerability via the golang-announce mailing list, and it was assigned GO-2026-5018 in the Go vulnerability database (golang-announce). The issue was also reported to the oss-security mailing list (oss-sec). Multiple Linux distributions including openSUSE and Amazon Linux 2023 have issued security advisories, and scanner vendors Nessus and Qualys have published detection plugins. Community reaction has been measured, consistent with a moderate-severity DoS with no active exploitation.