VDB
Sign up

GO-2026-6355

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Quick fix

GO-2026-6355 — golang.org/x/crypto: upgrade to the fixed version with the command below.

go get golang.org/x/crypto@v0.56.0

Details

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/golang.org/x/crypto
Introduced in: 0Fixed in: 0.56.0
Fixgo get golang.org/x/crypto@v0.56.0

References