{"id":"EUVD-2026-70267","revision":"cbc26bfb36cd4143983dfdafba66c141","records":[{"revision":"cbc26bfb36cd4143983dfdafba66c141","observedAt":"2026-10-28T08:16:22.655+00:00","statement":{"source":"euvd","id":"EUVD-2026-70267","aliases":["CVE-2026-56855"],"title":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all …","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://go.dev/issue/81317","https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70267","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 2, 2026, 7:37:05 PM","dateUpdated":"Sep 3, 2026, 2:14:40 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:4292-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11727-1","title":"rclone-1.75.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-33818","CVE-2026-46600","CVE-2026-46603","CVE-2026-56853","CVE-2026-56854","CVE-2026-56855","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78662"]},{"id":"SUSE-SU-2026:23841-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:21816-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2026-41888","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11717-1","title":"git-bug-0.10.1-7.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:21999-1","title":"Security update for rclone","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-46600","CVE-2026-46603","CVE-2026-56853","CVE-2026-56854","CVE-2026-56855","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:11691-1","title":"trivy-0.74.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:11920-1","title":"grafana-12.4.11-1.1 on GA media","vulnerabilityIds":["CVE-2026-15815","CVE-2026-56855","CVE-2026-76154","CVE-2026-79656","CVE-2026-83530","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21884-1","title":"Security update for amazon-ssm-agent","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-78662"]},{"id":"SUSE-SU-2026:4286-1","title":"Security update for amazon-ssm-agent","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-78662"]},{"id":"SUSE-SU-2026:23973-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:22064-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-78662","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2026-41888","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:23736-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-13622","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"SUSE-SU-2026:24213-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-78662","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11698-1","title":"gh-2.100.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","vulnerabilityIds":["CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41178","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21814-1","title":"Security update for zk","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:11772-1","title":"gitea-tea-0.16.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:11871-1","title":"cosign-3.1.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56855","CVE-2026-56864","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21846-1","title":"Security update for keybase-client","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:21927-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:70640","title":"Red Hat Security Advisory: buildah security update","vulnerabilityIds":["CVE-2025-11395","CVE-2026-15789","CVE-2026-33818","CVE-2026-56853","CVE-2026-56855","CVE-2026-56858","CVE-2026-56860","CVE-2026-56862"]},{"id":"SUSE-SU-2026:23874-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-33186","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2026-2303","CVE-2026-37236","CVE-2026-41178","CVE-2026-45679","CVE-2026-45680","CVE-2026-45681","CVE-2026-45683","CVE-2026-45684","CVE-2026-46600","CVE-2026-48496","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-75889","CVE-2026-78662","CVE-2026-81521","CVE-2026-89090"]},{"id":"SUSE-SU-2026:23745-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-33186","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"SUSE-SU-2026:23984-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"SUSE-SU-2026:23924-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"RHSA-2026:82322","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2","vulnerabilityIds":["CVE-2024-34459","CVE-2025-5278","CVE-2025-6170","CVE-2025-13151","CVE-2025-14087","CVE-2025-14512","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-1965","CVE-2026-2100","CVE-2026-2673","CVE-2026-3783","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-4424","CVE-2026-4437","CVE-2026-4438","CVE-2026-4878","CVE-2026-5121","CVE-2026-5260","CVE-2026-5419","CVE-2026-5435","CVE-2026-5450","CVE-2026-5928","CVE-2026-6238","CVE-2026-6653","CVE-2026-7383","CVE-2026-8286","CVE-2026-9076","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-13757","CVE-2026-14164","CVE-2026-15588","CVE-2026-16118","CVE-2026-25680","CVE-2026-25681","CVE-2026-27135","CVE-2026-27136","CVE-2026-28390","CVE-2026-29111","CVE-2026-29181","CVE-2026-31790","CVE-2026-33186","CVE-2026-33845","CVE-2026-33846","CVE-2026-34180","CVE-2026-34181","CVE-2026-34182","CVE-2026-34183","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-40355","CVE-2026-40356","CVE-2026-41989","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-42764","CVE-2026-42766","CVE-2026-42767","CVE-2026-42768","CVE-2026-42769","CVE-2026-42770","CVE-2026-45445","CVE-2026-45446","CVE-2026-45447","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-46600","CVE-2026-48864","CVE-2026-54369","CVE-2026-54370","CVE-2026-54371","CVE-2026-56854","CVE-2026-56855","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58055","CVE-2026-78662","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:11820-1","title":"helm-4.3.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"SUSE-SU-2026:23739-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4272-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-33186","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4308-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21861-1","title":"Security update for gh","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"RHSA-2026:82304","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2","vulnerabilityIds":["CVE-2024-34459","CVE-2025-5278","CVE-2025-6170","CVE-2025-13151","CVE-2025-14087","CVE-2025-14512","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-1965","CVE-2026-2100","CVE-2026-2673","CVE-2026-3783","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-4424","CVE-2026-4437","CVE-2026-4438","CVE-2026-4878","CVE-2026-5121","CVE-2026-5260","CVE-2026-5419","CVE-2026-5435","CVE-2026-5450","CVE-2026-5928","CVE-2026-6238","CVE-2026-6653","CVE-2026-7383","CVE-2026-8286","CVE-2026-9076","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-13757","CVE-2026-14164","CVE-2026-15588","CVE-2026-16118","CVE-2026-25680","CVE-2026-25681","CVE-2026-27135","CVE-2026-27136","CVE-2026-28390","CVE-2026-29111","CVE-2026-31790","CVE-2026-33186","CVE-2026-33845","CVE-2026-33846","CVE-2026-34180","CVE-2026-34181","CVE-2026-34182","CVE-2026-34183","CVE-2026-34986","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-40355","CVE-2026-40356","CVE-2026-41989","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-42764","CVE-2026-42766","CVE-2026-42767","CVE-2026-42768","CVE-2026-42769","CVE-2026-42770","CVE-2026-45445","CVE-2026-45446","CVE-2026-45447","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-46600","CVE-2026-48864","CVE-2026-54369","CVE-2026-54370","CVE-2026-54371","CVE-2026-56854","CVE-2026-56855","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58055","CVE-2026-78662","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-63209","CVE-2026-78662","CVE-2026-81870","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:11704-1","title":"kbfs-6.6.3-4.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:12258-1","title":"zk-0.15.7-1.1 on GA media","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"SUSE-SU-2026:23876-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"msrc_CVE-2026-56855","title":"Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh","vulnerabilityIds":["CVE-2026-56855"]},{"id":"openSUSE-SU-2026:21924-1","title":"Security update for cloudflared","vulnerabilityIds":["CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41178","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:21835-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2026-53495","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2026-24122","CVE-2026-37236","CVE-2026-41178","CVE-2026-50163","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21882-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2026-2303","CVE-2026-37236","CVE-2026-41178","CVE-2026-45679","CVE-2026-45680","CVE-2026-45681","CVE-2026-45683","CVE-2026-45684","CVE-2026-46600","CVE-2026-48496","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-71556","CVE-2026-71557","CVE-2026-75889","CVE-2026-78662","CVE-2026-81521","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:11685-1","title":"hauler-2.1.0-2.1 on GA media","vulnerabilityIds":["CVE-2026-56855"]},{"id":"SUSE-SU-2026:23831-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-70267","identifiers":["EUVD-2026-70267","CVE-2026-56855"]},"retained":false,"historicalAffected":[]}],"coverage":[]}