Problem
An authenticated SSH client that sends duplicate exec, shell, or subsystem requests on the same channel can trigger a send on closed channel panic in the request handler. The panic crashes the whole process, disconnecting every active session, and can be repeated for a sustained denial of service.
Desired behavior
- Session request handling validates channel state, so duplicate or out-of-order requests are rejected instead of panicking.
- A panic while serving a single connection is recovered and terminates only that connection, never the process.
Problem
An authenticated SSH client that sends duplicate exec, shell, or subsystem requests on the same channel can trigger a
send on closed channelpanic in the request handler. The panic crashes the whole process, disconnecting every active session, and can be repeated for a sustained denial of service.Desired behavior