CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

[
  {
    "vendor": "golang.org/x/crypto",
    "product": "golang.org/x/crypto/ssh",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "golang.org/x/crypto/ssh",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.52.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "channel.WriteExtended"
      },
      {
        "name": "Dial"
      },
      {
        "name": "NewClientConn"
      },
      {
        "name": "NewServerConn"
      },
      {
        "name": "Session.CombinedOutput"
      },
      {
        "name": "Session.Output"
      },
      {
        "name": "Session.Run"
      },
      {
        "name": "Session.Shell"
      },
      {
        "name": "Session.Start"
      },
      {
        "name": "channel.Write"
      },
      {
        "name": "curve25519sha256.Client"
      },
      {
        "name": "curve25519sha256.Server"
      },
      {
        "name": "dhGEXSHA.Client"
      },
      {
        "name": "dhGEXSHA.Server"
      },
      {
        "name": "dhGroup.Client"
      },
      {
        "name": "dhGroup.Server"
      },
      {
        "name": "ecdh.Client"
      },
      {
        "name": "ecdh.Server"
      },
      {
        "name": "extChannel.Write"
      },
      {
        "name": "mlkem768WithCurve25519sha256.Client"
      },
      {
        "name": "mlkem768WithCurve25519sha256.Server"
      }
    ],
    "defaultStatus": "unaffected"
  }
]