)]}'
{
  "commit": "3c7c86938f4541c333d506f719388d9c42d4763d",
  "tree": "abbec0c2c675deca1dde3d637acb2aa06901f63d",
  "parents": [
    "533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"
  ],
  "author": {
    "name": "Nicola",
    "email": "nicola.murino@gmail.com",
    "time": "Tue Apr 21 21:43:00 2026 +0200"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu May 21 17:09:12 2026 -0700"
  },
  "message": "ssh: fix deadlock on unexpected channel responses\n\nPreviously, channel.handlePacket sent channelRequestSuccess and\nchannelRequestFailure messages to ch.msg unconditionally via the default\narm of its type switch. Because ch.msg is a bounded buffer (chanSize),\na peer that sends a burst of unsolicited channel request responses for\nan open, idle channel fills the buffer and blocks the mux read loop on\nthe next send. That stalls all packet processing on the connection,\nand because readLoop then backs up on t.incoming, closing the\nunderlying net.Conn does not unblock either goroutine: user code\nobserves Close() returning promptly while Wait() hangs and the mux,\nreadLoop, and kexLoop goroutines leak permanently.\n\nThis change mirrors the fix for the mux-level SendRequest path: a\nsentRequestPending atomic gate is set while a SendRequest with\nWantReply is in flight, handlePacket drops responses when the gate is\nclosed, and uses a non-blocking send otherwise. SendRequest drains\nany spurious response that slipped through before discarding it, so\nthe caller always observes the reply to its own request.\n\nThis aligns with OpenSSH, which silently ignores channel confirm\nmessages that do not match a pending request.\n\nFixes golang/go#79564\nFixes CVE-2026-39830\n\nChange-Id: I15e2add4bf7876bb0c6f921f8b57203d97e83f47\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781664\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "77bac19af6516878a419e2d7d8257f035c921b84",
      "old_mode": 33188,
      "old_path": "ssh/channel.go",
      "new_id": "67379966bc5f48d99f368cc79454a39fdaa5697e",
      "new_mode": 33188,
      "new_path": "ssh/channel.go"
    },
    {
      "type": "modify",
      "old_id": "a0cae3413c5389363ad7a83235ebea8e6e036514",
      "old_mode": 33188,
      "old_path": "ssh/mux_test.go",
      "new_id": "65d22be8d21bdd953fa5037ce90ac90dff04ca57",
      "new_mode": 33188,
      "new_path": "ssh/mux_test.go"
    }
  ]
}