authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

{
  "id": "5736a56e514bb6ae5489ef1eb010e1eb14ee8e89bdff8115af65b87cfec8a83c",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-PN24745",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users",
    "summary": "Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users.",
    "evidence": "osv:CLEANSTART-2026-PN24745",
    "products": [
      {
        "name": {
          "value": "loki",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.7.1-r1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CLEANSTART-2026-PN24745",
      "aliases": [
        "CLEANSTART-2026-PN24745"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.7.1-r1"
                }
              ]
            }
          ],
          "package": {
            "name": "loki",
            "purl": "pkg:apk/cleanstart/loki",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-PN24745.json"
          }
        }
      ],
      "modified": "2026-10-08T16:47:30.181390394Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-39827"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PN24745.json",
        "https://osv.dev/vulnerability/CVE-2026-39827",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-39827",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 103312,
  "published_at": "2026-09-26T00:38:00.068+00:00"
}