CVE-2026-78662

Published: Sep 2, 2026Modified: Sep 4, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Affected (1)

Products: Golang: Crypto

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Golang Crypto	Before 0.56.0

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://go.dev/cl/826504

Source: security@golang.org

Patch

https://go.dev/issue/81316

Source: security@golang.org

Issue TrackingVendor Advisory

https://groups.google.com/g/golang-announce/c/1y3fb2np35U

Source: security@golang.org

Mailing ListVendor Advisory

https://pkg.go.dev/vuln/GO-2026-6354

Source: security@golang.org

PatchVendor Advisory

Timeline

No history available yet.