MediumFix available
authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
Type: advisorySources: OSV
CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details.
- Products
- external-dns, nfs-subdir-external-provisioner, ollama-fips, prometheus-mysqld-exporter, temporal-server-fips
- Affected versions
- Not specified
- Fixed versions
- 0.20.0-r3, 0.20.0-r4, 0.40.3-r1, 1.31.4-r2, 4.0.18-r3
- CVEs
- CVE-2026-39827
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 12:58 UTC · Revision 1
Source evidence
authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
core-osv · Original sourcePublished 15 Oct 2026, 00:41 UTC
CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details.
osv:CLEANSTART-2026-UF72074
ollama-fips
Fixed versions: 0.40.3-r1
ollama-fips
Fixed versions: 0.40.3-r1
temporal-server-fips
Fixed versions: 1.31.4-r2
prometheus-mysqld-exporter
Fixed versions: 0.20.0-r4
external-dns
Fixed versions: 0.20.0-r3
nfs-subdir-external-provisioner
Fixed versions: 4.0.18-r3
Complete source record
{
"id": "f777318126c2dbe3dbe5de38eb7ba8ee120f37e8a5c890fc9fb4912144973a1f",
"url": "https://osv.dev/vulnerability/CLEANSTART-2026-UF72074",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users",
"summary": "CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details.",
"evidence": "osv:CLEANSTART-2026-UF72074",
"products": [
{
"name": {
"value": "ollama-fips",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.40.3-r1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ollama-fips",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.40.3-r1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "temporal-server-fips",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.31.4-r2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "prometheus-mysqld-exporter",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.20.0-r4",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "external-dns",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.20.0-r3",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nfs-subdir-external-provisioner",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.0.18-r3",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "CLEANSTART-2026-UF72074",
"aliases": [
"CLEANSTART-2026-UF72074"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.40.3-r1"
}
]
}
],
"package": {
"name": "ollama-fips",
"purl": "pkg:apk/cleanstart/ollama-fips?arch=x86_64",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.40.3-r1"
}
]
}
],
"package": {
"name": "ollama-fips",
"purl": "pkg:apk/cleanstart/ollama-fips?arch=aarch64",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31.4-r2"
}
]
}
],
"package": {
"name": "temporal-server-fips",
"purl": "pkg:apk/cleanstart/temporal-server-fips",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0-r4"
}
]
}
],
"package": {
"name": "prometheus-mysqld-exporter",
"purl": "pkg:apk/cleanstart/prometheus-mysqld-exporter",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0-r3"
}
]
}
],
"package": {
"name": "external-dns",
"purl": "pkg:apk/cleanstart/external-dns",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.18-r3"
}
]
}
],
"package": {
"name": "nfs-subdir-external-provisioner",
"purl": "pkg:apk/cleanstart/nfs-subdir-external-provisioner",
"ecosystem": "CleanStart"
},
"database_specific": {
"source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UF72074.json"
}
}
],
"modified": "2026-10-15T01:00:14.388386456Z",
"provider": "osv",
"upstream": [
"CVE-2026-39827"
],
"references": [
"https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UF72074.json",
"https://osv.dev/vulnerability/CVE-2026-39827",
"https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-39827",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 318237,
"published_at": "2026-10-15T00:41:58.201091+00:00"
}