Is CVE-2026-56855 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56855 being exploited in the wild.

How severe is CVE-2026-56855?

High severity, with a CVSS score of 7.5, published 2 September 2026.

Which products and versions are affected?

golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; golang.org/x/crypto/ssh (Go) Prior to fix in CL/826524.

Is there a fix for CVE-2026-56855?

Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56855 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56855?

Check whether you run crypto (Go), golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56855: Go SSH deadlock vulnerability in channel handling

CVE-2026-56855 · Severity: high · CVSS 7.5 · Published 2026-09-02

A vulnerability in Go's SSH implementation allows a malicious peer to send specially crafted messages that can freeze (deadlock) an entire SSH connection after a channel has been established. This affects any application using Go's SSH library to accept remote connections, potentially causing denial of service and disconnection of legitimate users.

Technologies: crypto (Go), golang.org/x/crypto (Go), golang.org/x/crypto/ssh (Go). Vendors: Go.

Quick answers

Is CVE-2026-56855 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56855 being exploited in the wild.
How severe is CVE-2026-56855?: High severity, with a CVSS score of 7.5, published 2 September 2026.
Which products and versions are affected?: golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; golang.org/x/crypto/ssh (Go) Prior to fix in CL/826524.
Is there a fix for CVE-2026-56855?: Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56855 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56855?: Check whether you run crypto (Go), golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/crypto (Go): upgrade to 0.56.0 or later
```
go get golang.org/x/crypto@v0.56.0
```

Technical details

The vulnerability is a deadlock condition in Go's SSH channel message handling (RFC 4254). A malicious SSH peer can craft specific channel messages that cause the connection to deadlock and become unresponsive. The root cause is improper handling of unrecognized channel messages—previously these were buffered and blocked instead of being explicitly handled or rejected. The fix implements proper RFC 4254 compliance by explicitly handling channel messages and global requests, while treating all other messages as protocol errors and tearing down the connection. Attack requires network access to an SSH server using vulnerable Go SSH library; no authentication bypass occurs but availability impact is high.

Affected products

Go golang.org/x/crypto/ssh Prior to fix in CL/826524

Identifiers

CVE-2026-56855
GO-2026-6355

Timeline

2026-09-02: disclosed
2026-09-02: patched: Fix applied via CL/826524

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.