authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

{
  "id": "e9a6cf86a79d0b78328e8c8e80ad9dc35f188f51229779dd1b182bf4528a7578",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-CX44155",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users",
    "summary": "CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details.",
    "evidence": "osv:CLEANSTART-2026-CX44155",
    "products": [
      {
        "name": {
          "value": "external-dns",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.20.0-r2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "temporal-server-fips",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.32.0-r2",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CLEANSTART-2026-CX44155",
      "aliases": [
        "CLEANSTART-2026-CX44155"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.20.0-r2"
                }
              ]
            }
          ],
          "package": {
            "name": "external-dns",
            "purl": "pkg:apk/cleanstart/external-dns",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX44155.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.32.0-r2"
                }
              ]
            }
          ],
          "package": {
            "name": "temporal-server-fips",
            "purl": "pkg:apk/cleanstart/temporal-server-fips",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX44155.json"
          }
        }
      ],
      "modified": "2026-10-08T16:46:42.122190843Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-39827"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CX44155.json",
        "https://osv.dev/vulnerability/CVE-2026-39827",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-39827",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 101028,
  "published_at": "2026-10-08T00:40:15.259+00:00"
}