CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

[
  {
    "vendor": "golang.org/x/crypto",
    "product": "golang.org/x/crypto/ssh",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "golang.org/x/crypto/ssh",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.52.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "mux.SendRequest"
      },
      {
        "name": "mux.handleGlobalPacket"
      },
      {
        "name": "channel.handlePacket"
      },
      {
        "name": "channel.SendRequest"
      },
      {
        "name": "Client.Listen"
      },
      {
        "name": "Client.ListenTCP"
      },
      {
        "name": "Client.ListenUnix"
      },
      {
        "name": "Dial"
      },
      {
        "name": "NewClientConn"
      },
      {
        "name": "NewServerConn"
      },
      {
        "name": "Session.CombinedOutput"
      },
      {
        "name": "Session.Output"
      },
      {
        "name": "Session.RequestPty"
      },
      {
        "name": "Session.RequestSubsystem"
      },
      {
        "name": "Session.Run"
      },
      {
        "name": "Session.SendRequest"
      },
      {
        "name": "Session.Setenv"
      },
      {
        "name": "Session.Shell"
      },
      {
        "name": "Session.Signal"
      },
      {
        "name": "Session.Start"
      },
      {
        "name": "Session.WindowChange"
      },
      {
        "name": "tcpListener.Close"
      },
      {
        "name": "unixListener.Close"
      }
    ],
    "defaultStatus": "unaffected"
  }
]