Is CVE-2026-78662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78662 being exploited in the wild.

How severe is CVE-2026-78662?

Informational severity, published 2 September 2026.

Which products and versions are affected?

golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; x/crypto/ssh (Go) prior to 2026-09-02.

Is there a fix for CVE-2026-78662?

Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78662 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78662?

Check whether you run golang.org/x/crypto (Go) or x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78662: Go x/crypto/ssh deadlock denial of service on undecided channel

CVE-2026-78662 · Severity: info · Published 2026-09-02

The Go SSH library (golang.org/x/crypto/ssh) contains a vulnerability where a malicious SSH peer can flood incoming requests on a channel that hasn't yet been established, causing the entire SSH connection to deadlock. This allows an attacker to deny service to applications using the library by making legitimate SSH connections unresponsive.

Technologies: golang.org/x/crypto (Go). Vendors: Go.

Quick answers

Is CVE-2026-78662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78662 being exploited in the wild.
How severe is CVE-2026-78662?: Informational severity, published 2 September 2026.
Which products and versions are affected?: golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; x/crypto/ssh (Go) prior to 2026-09-02.
Is there a fix for CVE-2026-78662?: Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78662 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78662?: Check whether you run golang.org/x/crypto (Go) or x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/crypto (Go): upgrade to 0.56.0 or later
```
go get golang.org/x/crypto@v0.56.0
```

Technical details

The vulnerability exists in the SSH multiplexer's channel handling: channels registered in chanList become usable only after establishment, but prior to establishment the mux would block processing incoming requests on unestablished channels. An attacker can exploit this by flooding incomingRequests on a channel before it's established, deadlocking the connection handler. The fix introduces an atomic established state flag and modifies handlePacket to drop non-critical packets on undecided channels without blocking.

Affected products

golang x/crypto/ssh prior to 2026-09-02

Identifiers

CVE-2026-78662
GO-2026-6354

Timeline

2026-09-02: disclosed: Issue GO-2026-6354 published
2026-09-02: other: CVE-2026-78662 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.