CVE-2026-56855

CVE-2026-56855 is a remote denial-of-service flaw in the SSH implementation of Go's golang.org/x/crypto library, in which, after an SSH channel is established, a malicious peer can send crafted protocol messages that deadlock the entire connection. The implementation buffered and blocked on unexpected RFC 4254 channel messages and global requests instead of rejecting them, an unbounded-resource pattern (CWE-770) that lets an attacker stall the connection. Per the CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N, availability high, confidentiality and integrity unaffected), an attacker gains high-impact availability loss on affected SSH sessions, with no code execution or data compromise. Any application or service built on the affected Go SSH library is exposed whenever it communicates with a malicious peer, on both the client and server sides. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Update golang.org/x/crypto to the latest patched release and rebuild all Go applications that depend on it (run govulncheck or inspect go.sum/go.mod for the dependency), as the source data does not include a fixed version number. Until patched, restrict SSH endpoints to trusted peers and monitor for hung or deadlocked SSH connections, since a malicious peer needs only an established channel to trigger the deadlock.