Bug 2528050 (CVE-2026-56855) - CVE-2026-56855 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages
Summary: CVE-2026-56855 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Se...
Keywords:
Status: NEW
Alias: CVE-2026-56855
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2530562 2530564 2530565 2530566 2530567 2530568 2530569 2530570 2530571 2530572 2530573 2530574 2530575 2530576 2530577 2530578 2530579 2530581 2530582 2530583 2530584 2530585 2530586 2530587 2530588 2530589 2530590 2530591 2530592 2530593 2530594 2530595 2530596 2530597 2530598 2530599 2530600 2530601 2530602 2530603 2530604 2530605 2530606 2530608 2530609 2530610 2530611 2530612 2530619 2530620 2530621 2530623 2530624 2530625 2530627 2530628 2530629 2530630 2530631 2530632 2530633 2530634 2530635 2530637 2530638 2530639 2530640 2530641 2530642 2530643 2530644 2530645 2530646 2530671 2530673 2530675 2530677 2530679 2530680 2530681 2530682 2530683 2530684 2530685 2530686 2530687 2530688 2530689 2530690 2530563 2530580 2530607 2530622 2530626 2530636 2530647 2530693
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-03 14:28 UTC by OSIDB Bzimport
Modified: 2026-09-09 10:35 UTC (History)
82 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-03 14:28:16 UTC 
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Note You need to log in before you can comment on or make changes to this bug.