CVE-2026-78662

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

CVE-2026-78662 is fixed in 30 products on 1 platform, first by DEBIAN-CVE-2026-78662, released September 8, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.5
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0043
37th percentile

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Where it's fixed

ProductFixed inFixReleased
Linux
alloy · opensuse-leap 16.0 1.19.2-160000.1.1 OPENSUSE-SU-2026:22032-1 Oct 6, 2026
alloy · sles 15.7 1.19.2-150700.15.29.1 SUSE-SU-2026:4408-1 Oct 1, 2026
alloy · sles 16.0 1.19.2-160000.1.1 SUSE-SU-2026:24148-1 Oct 6, 2026
amazon-ssm-agent · amzn 2023 3.3.5390.0-1.amzn2023 ALAS2023-2026-3160 Nov 7, 2026
amazon-ssm-agent · opensuse-leap 16.0 3.3.5390.0-160000.1.1 OPENSUSE-SU-2026:21884-1 Sep 20, 2026
amazon-ssm-agent · sles 15.6 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1 Sep 28, 2026
amazon-ssm-agent · sles 15.7 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1 Sep 28, 2026
apptainer · opensuse-leap 16.0 1.5.3-bp160.4.1 OPENSUSE-SU-2026:21927-1 Sep 21, 2026
apptainer · sles 15.7 1.5.3-150600.4.43.1 SUSE-SU-2026:4308-1 Sep 23, 2026
cloudflared · opensuse-leap 16.0 2026.9.1-bp160.1.1 OPENSUSE-SU-2026:21924-1 Sep 21, 2026
containerd · amzn 2023 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273 Nov 7, 2026
containerd-debuginfo · amzn 2023 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273 Nov 7, 2026
containerd-debugsource · amzn 2023 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273 Nov 7, 2026
containerd-stress · amzn 2023 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273 Nov 7, 2026
containerd-stress-debuginfo · amzn 2023 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273 Nov 7, 2026
containerized-data-importer · sles 15.7 1.64.0-150700.9.14.1 SUSE-SU-2026:4209-1 Sep 16, 2026
containerized-data-importer1.65 · opensuse-leap 16.0 1.65.0-160000.3.1 OPENSUSE-SU-2026:21824-1 Sep 9, 2026
cosign · opensuse-leap 16.0 3.1.3-160000.1.1 OPENSUSE-SU-2026:22064-1 Nov 7, 2026
cosign · sles 15.6 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1 Sep 29, 2026
cosign · sles 15.7 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1 Sep 29, 2026
cosign · sles 16.0 3.1.3-160000.1.1 SUSE-SU-2026:24213-1 Nov 7, 2026
gh · opensuse-leap 16.0 2.100.0-bp160.1.1 OPENSUSE-SU-2026:21861-1 Sep 15, 2026
golang-go.crypto · Debian 14 1:0.56.0-1 DEBIAN-CVE-2026-78662 Sep 8, 2026
google-guest-agent · opensuse-leap 16.0 20260903.01-160000.1.1 OPENSUSE-SU-2026:21879-1 Sep 18, 2026
google-guest-agent · sles 15.6 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1 Sep 21, 2026
google-guest-agent · sles 15.7 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1 Sep 21, 2026
google-osconfig-agent · opensuse-leap 16.0 20260911.00-160000.1.1 OPENSUSE-SU-2026:21882-1 Sep 19, 2026
google-osconfig-agent · sles 15.6 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1 Sep 23, 2026
google-osconfig-agent · sles 15.7 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1 Sep 23, 2026
govulncheck-vulndb · opensuse-leap 16.0 0.0.20260902T191204-160000.1.1 OPENSUSE-SU-2026:21812-1 Sep 8, 2026
govulncheck-vulndb · sles 16.0 0.0.20260902T191204-160000.1.1 SUSE-SU-2026:23712-1 Sep 8, 2026
hauler · opensuse-leap 16.0 2.1.0-bp160.3.1 OPENSUSE-SU-2026:21841-1 Sep 14, 2026
hcloud · Fedora 43 1.69.0-1.fc43 FEDORA-2026-6D4A64A6B0 Sep 30, 2026
hcloud-debuginfo · Fedora 43 1.69.0-1.fc43 FEDORA-2026-6D4A64A6B0 Sep 30, 2026
hcloud-debugsource · Fedora 43 1.69.0-1.fc43 FEDORA-2026-6D4A64A6B0 Sep 30, 2026
helm · opensuse-leap 16.0 4.3.0-160000.1.1 OPENSUSE-SU-2026:21983-1 Sep 30, 2026
helm · sles 16.0 4.3.0-160000.1.1 SUSE-SU-2026:23984-1 Sep 30, 2026
keybase-client · opensuse-leap 16.0 6.6.3-bp160.3.1 OPENSUSE-SU-2026:21846-1 Sep 14, 2026
nerdctl · amzn 2023 2.3.5-1.amzn2023.0.2 ALAS2023-2026-3274 Nov 7, 2026
rclone · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
rclone · opensuse-leap 16.0 1.75.1-bp160.1.1 OPENSUSE-SU-2026:21999-1 Sep 28, 2026
rclone-debuginfo · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
rclone-debugsource · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
runfinch-finch · amzn 2023 1.19.0-1.amzn2023.0.1 ALAS2023-2026-3140 Sep 28, 2026
trivy · opensuse-leap 16.0 0.74.0-160000.3.1 OPENSUSE-SU-2026:21835-1 Sep 14, 2026
zk · opensuse-leap 16.0 0.15.6-bp160.2.1 OPENSUSE-SU-2026:21814-1 Sep 8, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.