CVE-2026-78662

highpriority · track · 0EPSS 0.004 · 37 %ileFRUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.43% (37th) EPSS

CVSS 7.5 · high

Is it mine?

2 products

Check your exposure

Who says so?

3 sources

nvd · osv · certfr

EPSS · scored 2026-10-28

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-770US

affected products (2)

Products and version ranges known to be affected.

golang crypto< 0.56.0nvdUScpe:2.3:a:golang:crypto:*:*:*:*:*:*:*:*
Go golang.org/x/crypto< 0.56.0osvUSpkg:golang/golang.org/x/crypto

advisories (2)

Vendor and ecosystem advisories describing this.

CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
GO-2026-6354Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh2026-09-02vendor · osvUS
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

sources

Which sources assert this record, and when.

nvd osv certfr NVD CVE.org MITRE

published 2026-09-02modified 2026-09-04

references (4) nvd

External citations — patches, advisories, analysis.

https://go.dev/cl/826504Patch
https://go.dev/issue/81316Issue TrackingVendor Advisory
https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing ListVendor Advisory
https://pkg.go.dev/vuln/GO-2026-6354PatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan