CVE-2026-56855
CVE-2026-56855 · Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
CVSS 7.5 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
golang.org/x/crypto/ssh
- Versions
- ≥ 0, < 0.56.0: Affected (semver)
Update to 0.56.0
golang-go.crypto Debian:12
- Versions
- 1:0.10.0-1
- 1:0.12.0-1
- 1:0.13.0-1
- 1:0.14.0-1
- 1:0.16.0-1
- 1:0.17.0-1
- 1:0.18.0-1
- 1:0.19.0-1
- 1:0.21.0-1
- 1:0.22.0-1
- 1:0.23.0-1
- 1:0.24.0-1
- 1:0.24.0-2
- 1:0.25.0-1
- 1:0.25.0-1~bpo12+1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.4.0-1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:13
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:14
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- Affected ranges
- ECOSYSTEM: < 1:0.56.0-1
Update to 1:0.56.0-1
golang-defaults Ubuntu:16.04:LTS
- Versions
- 2:1.6-1ubuntu3
- 2:1.6-1ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:18.04:LTS
- Versions
- 2:1.8~1ubuntu1
- 2:1.9~2ubuntu1
- 2:1.10~4ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:20.04:LTS
- Versions
- 2:1.12~1ubuntu1
- 2:1.13~1ubuntu1
- 2:1.13~1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:22.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~22.04
- 1.20.3-1ubuntu0.1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:22.04:LTS
- Versions
- 1.21.1-1~ubuntu22.04.1
- 1.21.1-1~ubuntu22.04.2
- 1.21.1-1~ubuntu22.04.3
- 1.21.1-1~ubuntu22.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.23 Ubuntu:22.04:LTS
- Versions
- 1.23.1-1~22.04
- 1.23.1-1~22.04.2
- 1.23.1-1~22.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:22.04:LTS
- Versions
- 1.24.4-1ubuntu1~22.04.1
- 1.24.4-1ubuntu1~22.04.2
- 1.24.13-2~22.04.1
- 1.24.13-2~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:22.04:LTS
- Versions
- 1.25.14-1~ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:22.04:LTS
- Versions
- 1.26.8-1~ubuntu0.22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:22.04:LTS
- Versions
- 2:1.17~0ubuntu1
- 2:1.17~1
- 2:1.18~0ubuntu1
- 2:1.18~0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:24.04:LTS
- Versions
- 1.21.1-1
- 1.21.3-1
- 1.21.4-1
- 1.21.5-1
- 1.21.6-1
- 1.21.7-1
- 1.21.7-2
- 1.21.8-1
- 1.21.8-1build1
- 1.21.9-1
- 1.21.9-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.23 Ubuntu:24.04:LTS
- Versions
- 1.23.1-1~24.04
- 1.23.1-1~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:24.04:LTS
- Versions
- 1.24.4-1ubuntu1~24.04.1
- 1.24.4-1ubuntu1~24.04.2
- 1.24.13-2~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:24.04:LTS
- Versions
- 1.25.14-1~ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:24.04:LTS
- Versions
- 1.26.8-1~ubuntu0.24.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:24.04:LTS
- Versions
- 2:1.21~2
- 2:1.21~3
- 2:1.22~2
- 2:1.22~2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:26.10
- Versions
- 1.26.0-1
- 1.26.2-3
- 1.26.4-1
- 1.26.5-1
- 1.26.6-2
- 1.26.7-1
- 1.26.8-1
- 1.26.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published