# CVE-2026-56855: Go SSH deadlock vulnerability in channel handling

Source: https://junglewise.ai/threats/cve-2026-56855-go-ssh-deadlock-vulnerability-in-channel-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56855 · Severity: high · CVSS 7.5 · Published 2026-09-02

A vulnerability in Go's SSH implementation allows a malicious peer to send specially crafted messages that can freeze (deadlock) an entire SSH connection after a channel has been established. This affects any application using Go's SSH library to accept remote connections, potentially causing denial of service and disconnection of legitimate users.

Technologies: [crypto (Go)](https://junglewise.ai/threats/technologies/crypto), [golang.org/x/crypto (Go)](https://junglewise.ai/threats/technologies/golang-org-x-crypto), [golang.org/x/crypto/ssh (Go)](https://junglewise.ai/threats/technologies/golang-org-x-crypto-ssh). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-56855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56855 being exploited in the wild.

**How severe is CVE-2026-56855?** High severity, with a CVSS score of 7.5, published 2 September 2026.

**Which products and versions are affected?** golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; golang.org/x/crypto/ssh (Go) Prior to fix in CL/826524.

**Is there a fix for CVE-2026-56855?** Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56855 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56855?** Check whether you run crypto (Go), golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/crypto (Go): upgrade to 0.56.0 or later

  ```sh
  go get golang.org/x/crypto@v0.56.0
  ```


## Technical details

The vulnerability is a deadlock condition in Go's SSH channel message handling (RFC 4254). A malicious SSH peer can craft specific channel messages that cause the connection to deadlock and become unresponsive. The root cause is improper handling of unrecognized channel messages—previously these were buffered and blocked instead of being explicitly handled or rejected. The fix implements proper RFC 4254 compliance by explicitly handling channel messages and global requests, while treating all other messages as protocol errors and tearing down the connection. Attack requires network access to an SSH server using vulnerable Go SSH library; no authentication bypass occurs but availability impact is high.

## Affected products

- Go golang.org/x/crypto/ssh Prior to fix in CL/826524

## Identifiers

- CVE-2026-56855
- GO-2026-6355

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Fix applied via CL/826524

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/826524](https://go.dev/cl/826524)

## Related threats

- [Go x/crypto/ssh deadlock denial of service on undecided channel](https://junglewise.ai/threats/cve-2026-78662-go-2026-6354-prevent-dos-on-deadlocked-undecided-channel-in)
- [Go SSH source-address permission validation bypass in authentication callbacks](https://junglewise.ai/threats/cve-2026-56854-go-ssh-source-address-permission-validation-bypass-in)
- [GO-2026-5932 - The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues](https://junglewise.ai/threats/go-2026-5932-the-golang-org-x-crypto-openpgp-package-is-unmaintained-7e8ca4de)
- [Go x/crypto denial of service in SSH agent Ed25519 parsing](https://junglewise.ai/threats/cve-2026-46598-go-x-crypto-denial-of-service-in-ssh-agent-ed25519-parsing)
- [Go x/crypto/ssh denial of service in AES-GCM decoder](https://junglewise.ai/threats/cve-2026-46597-go-x-crypto-ssh-denial-of-service-in-aes-gcm-decoder)