CVE-2026-78662
CVE-2026-78662 · Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
golang.org/x/crypto/ssh
- Versions
- ≥ 0, < 0.56.0: Affected (semver)
Update to 0.56.0
golang-go.crypto Debian:12
- Versions
- 1:0.10.0-1
- 1:0.12.0-1
- 1:0.13.0-1
- 1:0.14.0-1
- 1:0.16.0-1
- 1:0.17.0-1
- 1:0.18.0-1
- 1:0.19.0-1
- 1:0.21.0-1
- 1:0.22.0-1
- 1:0.23.0-1
- 1:0.24.0-1
- 1:0.24.0-2
- 1:0.25.0-1
- 1:0.25.0-1~bpo12+1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.4.0-1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:13
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- 1:0.56.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-go.crypto Debian:14
- Versions
- 1:0.25.0-1
- 1:0.33.0-1~exp1
- 1:0.36.0-1~exp1
- 1:0.41.0-1~exp1
- 1:0.42.0-1
- 1:0.42.0-1~exp1
- 1:0.42.0-2
- 1:0.42.0-3
- 1:0.42.0-4
- 1:0.43.0-1
- 1:0.43.0-2
- 1:0.45.0-1
- 1:0.46.0-1
- 1:0.47.0-1
- 1:0.50.0-1
- 1:0.52.0-1
- 1:0.52.0-1~bpo13+1
- 1:0.53.0-1
- 1:0.54.0-1
- 1:0.55.0-1
- Affected ranges
- ECOSYSTEM: < 1:0.56.0-1
Update to 1:0.56.0-1
golang-defaults Ubuntu:16.04:LTS
- Versions
- 2:1.6-1ubuntu3
- 2:1.6-1ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:18.04:LTS
- Versions
- 2:1.8~1ubuntu1
- 2:1.9~2ubuntu1
- 2:1.10~4ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:20.04:LTS
- Versions
- 2:1.12~1ubuntu1
- 2:1.13~1ubuntu1
- 2:1.13~1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:22.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~22.04
- 1.20.3-1ubuntu0.1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:22.04:LTS
- Versions
- 1.21.1-1~ubuntu22.04.1
- 1.21.1-1~ubuntu22.04.2
- 1.21.1-1~ubuntu22.04.3
- 1.21.1-1~ubuntu22.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.23 Ubuntu:22.04:LTS
- Versions
- 1.23.1-1~22.04
- 1.23.1-1~22.04.2
- 1.23.1-1~22.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:22.04:LTS
- Versions
- 1.24.4-1ubuntu1~22.04.1
- 1.24.4-1ubuntu1~22.04.2
- 1.24.13-2~22.04.1
- 1.24.13-2~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:22.04:LTS
- Versions
- 1.25.14-1~ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:22.04:LTS
- Versions
- 1.26.8-1~ubuntu0.22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:22.04:LTS
- Versions
- 2:1.17~0ubuntu1
- 2:1.17~1
- 2:1.18~0ubuntu1
- 2:1.18~0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:24.04:LTS
- Versions
- 1.21.1-1
- 1.21.3-1
- 1.21.4-1
- 1.21.5-1
- 1.21.6-1
- 1.21.7-1
- 1.21.7-2
- 1.21.8-1
- 1.21.8-1build1
- 1.21.9-1
- 1.21.9-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.23 Ubuntu:24.04:LTS
- Versions
- 1.23.1-1~24.04
- 1.23.1-1~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:24.04:LTS
- Versions
- 1.24.4-1ubuntu1~24.04.1
- 1.24.4-1ubuntu1~24.04.2
- 1.24.13-2~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:24.04:LTS
- Versions
- 1.25.14-1~ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:24.04:LTS
- Versions
- 1.26.8-1~ubuntu0.24.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-defaults Ubuntu:24.04:LTS
- Versions
- 2:1.21~2
- 2:1.21~3
- 2:1.22~2
- 2:1.22~2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:26.10
- Versions
- 1.26.0-1
- 1.26.2-3
- 1.26.4-1
- 1.26.5-1
- 1.26.6-2
- 1.26.7-1
- 1.26.8-1
- 1.26.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published