GO-2026-6355Published
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-56855 · CVE overview and exploitation status
cve-program · CVE-2026-56855
- https://go.dev/issue/81317
- https://go.dev/cl/826524
- https://groups.google.com/g/golang-announce/c/1y3fb2np35U
- https://pkg.go.dev/vuln/GO-2026-6355
euvd · EUVD-2026-70267
- https://go.dev/issue/81317
- https://go.dev/cl/826524
- https://groups.google.com/g/golang-announce/c/1y3fb2np35U
- https://pkg.go.dev/vuln/GO-2026-6355
nvd · CVE-2026-56855
- https://go.dev/cl/826524
- https://go.dev/issue/81317
- https://groups.google.com/g/golang-announce/c/1y3fb2np35U
- https://pkg.go.dev/vuln/GO-2026-6355
osv · GO-2026-6355
Related changes
Linked by CVE identifier- Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all … · Advisory content revised · 7 Nov 2026
- Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all … · Advisory content revised · 30 Oct 2026