GO-2026-6355

    Dashboard / Vulnerabilities / GO-2026-6355

    GO-2026-6355

    Published: 2 Sept 2026Last Modified: 3 Sept 2026

    Summary: Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

    Details: Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

    References: https://go.dev/issue/81317, https://go.dev/cl/826524, https://groups.google.com/g/golang-announce/c/1y3fb2np35U

    Affected packages

    Package

    Name: golang.org/x/crypto

    Purl: pkg:golang/golang.org/x/crypto

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.56.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High