Executive brief
The Go SSH library (golang.org/x/crypto/ssh) contains a vulnerability where a malicious SSH peer can flood incoming requests on a channel that hasn't yet been established, causing the entire SSH connection to deadlock. This allows an attacker to deny service to applications using the library by making legitimate SSH connections unresponsive.
Technical details
The vulnerability exists in the SSH multiplexer's channel handling: channels registered in chanList become usable only after establishment, but prior to establishment the mux would block processing incoming requests on unestablished channels. An attacker can exploit this by flooding incomingRequests on a channel before it's established, deadlocking the connection handler. The fix introduces an atomic established state flag and modifies handlePacket to drop non-critical packets on undecided channels without blocking.
Affected products
- golang x/crypto/ssh prior to 2026-09-02
Timeline
- 2026-09-02: disclosed: Issue GO-2026-6354 published
- 2026-09-02: other: CVE-2026-78662 assigned