CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

• CWE-770

• https://go.dev/cl/826504Patch
• https://go.dev/issue/81316Issue Tracking, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2026-6354Patch, Vendor Advisory

Published

Sep 2, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78654A vulnerability has been found in cleverbrush framework and …7.3
• CVE-2026-78655Punk::Plugin::TOTP versions before 0.05 for Perl allow the s…9.1
• CVE-2026-78656A vulnerability was found in itsourcecode Sales and Inventor…6.3
• CVE-2026-78657The SigmaForms Pro – AI Generated Forms plugin for WordPress…9.8
• CVE-2026-78658IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3…6.5
• CVE-2026-7866Stack-based Buffer Overflow vulnerability in RTI Connext Pro…10
• CVE-2026-78668Rejected reason: reserved but not needed
• CVE-2026-7867A flaw was found in udisks2. A local attacker with an active…7.8
• CVE-2026-78675GitPython before 3.1.59 fails to disable merge_includes when…7.8
• CVE-2026-78676GitPython before 3.1.59 fails to safely re-serialize multi-l…9.8
• CVE-2026-78677GitPython before 3.1.59 omits --separate-git-dir from unsafe…7.5
• CVE-2026-78678GitPython versions before 3.1.59 contain an incomplete denyl…6.5