Bug 2528050 (CVE-2026-56855)

Summary: CVE-2026-56855 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, akhatavk, akoudelk, amctagga, anjoseph, aoconnor, aos-team-art-private, aruklets, asdas, bniver, cmah, crizzo, dakwon, dhanak, dkeler, doconnor, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, flucifre, gbenhaim, gmeno, gparvin, groman, jburrell, jdelft, jeder, jjoyce, jmatsuok, jmatthew, jprabhak, jpretori, jschluet, jtolenti, jupierce, kingland, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, ngough, niyer, pjindal, ppalepu, ppostler, prdhamdh, rekumar, rhaigner, rhel-process-autobot, rjohnson, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, sostapov, suppawar, thason, twaugh, vereddy, veshanka, vkarehfa, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS) for the affected system.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2530562, 2530564, 2530565, 2530567, 2530568, 2530569, 2530570, 2530571, 2530572, 2530573, 2530574, 2530575, 2530576, 2530577, 2530578, 2530579, 2530581, 2530582, 2530583, 2530584, 2530585, 2530587, 2530588, 2530589, 2530590, 2530591, 2530592, 2530593, 2530594, 2530595, 2530596, 2530597, 2530598, 2530599, 2530600, 2530601, 2530602, 2530603, 2530604, 2530605, 2530606, 2530608, 2530609, 2530610, 2530611, 2530612, 2530619, 2530620, 2530621, 2530623, 2530624, 2530625, 2530627, 2530628, 2530629, 2530630, 2530632, 2530634, 2530635, 2530637, 2530638, 2530639, 2530640, 2530641, 2530642, 2530643, 2530644, 2530645, 2530646, 2530671, 2530673, 2530675, 2530677, 2530679, 2530680, 2530681, 2530682, 2530683, 2530684, 2530685, 2530686, 2530687, 2530688, 2530689, 2530563, 2530566, 2530580, 2530586, 2530607, 2530622, 2530626, 2530631, 2530633, 2530636, 2530647, 2530690, 2530693    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-03 14:28:16 UTC
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.