CVE-2026-39835 is a vulnerability in the Go standard cryptography library (golang.org/x/crypto/ssh) that allows a remote attacker to trigger a server panic — effectively crashing the SSH server — during the host key check or authentication phase. This is a denial-of-service risk affecting any service or application built with this Go SSH package, including components deployed on Azure. It matters because a crash during authentication can be exploited without valid credentials, making it trivially weaponisable.

Architect’s Take: Audit your Azure workloads and internal tooling for applications built with golang.org/x/crypto/ssh and prioritise patching to a fixed version of the library. Pay particular attention to Go-based microservices, infrastructure tooling, and any Azure-hosted SSH gateways or bastion services that may use this package.

Original advisory: CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh