CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
A malicious peer can deadlock established SSH connections in the Go crypto library, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56855?
CVE-2026-56855 is a high-severity denial of service vulnerability in golang.org/x/crypto/ssh, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Weakness: CWE-770
Which versions are affected by CVE-2026-56855?
1 open source package ship an affected version, including golang.org/x/crypto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/crypto Go | All versions | 0.56.0 |
Linux distribution packages (7)
gh openSUSE:Tumbleweed | All versions | 2.100.0-1.1 |
git-bug openSUSE:Tumbleweed | All versions | 0.10.1-7.1 |
gitea-tea openSUSE:Tumbleweed | All versions | 0.16.0-1.1 |
hauler openSUSE:Tumbleweed | All versions | 2.1.0-2.1 |
helm openSUSE:Tumbleweed | All versions | 4.3.0-1.1 |
keybase-client openSUSE:Tumbleweed | All versions | 6.6.3-4.1 |
trivy openSUSE:Tumbleweed | All versions | 0.74.0-3.1 |
Products include Golang Crypto.
How do I fix CVE-2026-56855?
Upgrade golang.org/x/crypto to 0.56.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-56855 being exploited?
There is no known exploitation of CVE-2026-56855 in the wild and no public exploit code.
Other vulnerabilities in golang.org/x/crypto/ssh
- CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
- CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
- CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
- CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
- CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
Sources
Also known as AZL-99123, AZL-99135, AZL-99147, AZL-99159, AZL-99168, AZL-99198 and 1499 more.