AZL-87762 CVE-2026-39834 affecting package gh for versions less than 2.62.0-16

🗓️ 22 May 2026 04:16:24Reported by GoogleType

osv🔗 osv.dev👁 12 Views

Integer overflow in gh SSH channel payload size calc causes infinite loop on 4GB+ writes.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Sep 202613:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in golang.org/x/crypto bundled with IBM Fusion and IBM Fusion HCI.	5 Oct 202619:30	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Golang Go, multiple vulnerabilities affect IBM Cloud Pak System	7 Oct 202623:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management	29 Sep 202616:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	24 Jul 202622:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities	3 Aug 202608:33	–	ibm
attackerkb	CVE-2026-39834	22 May 202602:31	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1784)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nerdctl (ALAS2023-2026-1788)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1809)	8 Jun 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-39834

08 Sep 2026 17:33Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.19.1

EPSS0.00637

SSVC

gh integer overflow SSH channel denial of service payload size