# CVE-2026-78662: Go x/crypto/ssh deadlock denial of service on undecided channel

Source: https://junglewise.ai/threats/cve-2026-78662-go-2026-6354-prevent-dos-on-deadlocked-undecided-channel-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78662 · Severity: info · Published 2026-09-02

The Go SSH library (golang.org/x/crypto/ssh) contains a vulnerability where a malicious SSH peer can flood incoming requests on a channel that hasn't yet been established, causing the entire SSH connection to deadlock. This allows an attacker to deny service to applications using the library by making legitimate SSH connections unresponsive.

Technologies: [golang.org/x/crypto (Go)](https://junglewise.ai/threats/technologies/golang-org-x-crypto). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-78662 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78662 being exploited in the wild.

**How severe is CVE-2026-78662?** Informational severity, published 2 September 2026.

**Which products and versions are affected?** golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.56.0; x/crypto/ssh (Go) prior to 2026-09-02.

**Is there a fix for CVE-2026-78662?** Yes. golang.org/x/crypto (Go): upgrade to 0.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78662 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78662?** Check whether you run golang.org/x/crypto (Go) or x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/crypto (Go): upgrade to 0.56.0 or later

  ```sh
  go get golang.org/x/crypto@v0.56.0
  ```


## Technical details

The vulnerability exists in the SSH multiplexer's channel handling: channels registered in chanList become usable only after establishment, but prior to establishment the mux would block processing incoming requests on unestablished channels. An attacker can exploit this by flooding incomingRequests on a channel before it's established, deadlocking the connection handler. The fix introduces an atomic established state flag and modifies handlePacket to drop non-critical packets on undecided channels without blocking.

## Affected products

- golang x/crypto/ssh prior to 2026-09-02

## Identifiers

- CVE-2026-78662
- GO-2026-6354

## Timeline

- 2026-09-02: disclosed: Issue GO-2026-6354 published
- 2026-09-02: other: CVE-2026-78662 assigned

## References

- [https://go.dev/issue/81316](https://go.dev/issue/81316)
- [https://go.dev/cl/826504](https://go.dev/cl/826504)

## Related threats

- [Go SSH deadlock vulnerability in channel handling](https://junglewise.ai/threats/cve-2026-56855-go-ssh-deadlock-vulnerability-in-channel-handling)
- [Go SSH source-address permission validation bypass in authentication callbacks](https://junglewise.ai/threats/cve-2026-56854-go-ssh-source-address-permission-validation-bypass-in)
- [GO-2026-5932 - The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues](https://junglewise.ai/threats/go-2026-5932-the-golang-org-x-crypto-openpgp-package-is-unmaintained-7e8ca4de)
- [Go x/crypto denial of service in SSH agent Ed25519 parsing](https://junglewise.ai/threats/cve-2026-46598-go-x-crypto-denial-of-service-in-ssh-agent-ed25519-parsing)
- [Go x/crypto/ssh denial of service in AES-GCM decoder](https://junglewise.ai/threats/cve-2026-46597-go-x-crypto-ssh-denial-of-service-in-aes-gcm-decoder)