CVE-2026-56855

Received Received - Intake

Remote Channel Deadlock in Go SSH Implementation

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Go Project

Description

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-02

Generated

2026-09-03

AI Q&A

2026-09-03

EPSS Evaluated

N/A

NVD

CVE-2026-56855

EUVD

EUVD-2026-70267

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to v0.56.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the golang.org/x/crypto/ssh package before version v0.56.0. A malicious peer could send crafted messages after establishing an SSH channel, causing a deadlock in the entire connection. The issue arises because unexpected messages were buffered and blocked instead of being handled properly.

Detection Guidance

To detect this vulnerability, check the version of the golang.org/x/crypto/ssh package in use. If it is before v0.56.0, the system is vulnerable. Commands like 'go list -m golang.org/x/crypto@version' or inspecting project dependencies can help verify the package version.

Impact Analysis

If you use the affected Go SSH package, an attacker could exploit this to freeze SSH connections, leading to service disruptions or denial of service. Systems relying on SSH for secure communication could become unresponsive or crash.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a denial-of-service issue in the golang.org/x/crypto/ssh package that could cause connection deadlocks, but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the golang.org/x/crypto/ssh package to version v0.56.0 or later. This can be done using 'go get -u golang.org/x/crypto/ssh@latest' or by updating project dependencies to use the patched version.

Hi! I’m here to help you understand CVE-2026-56855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70