CVE-2026-56855

The golang.org/x/crypto/ssh package is vulnerable to a Denial of Service (DoS) condition where a malicious peer can send crafted messages after a channel is established to deadlock the entire connection . The root cause is the improper handling of channel messages, where certain messages would be...

CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-78662

A vulnerability exists where a channel registered in the mux's chanList was not usable until established, allowing a malicious peer to flood incomingRequests and deadlock the entire connection . The issue is addressed by adding an atomic established state ; once set, the handlePacket function dro...

CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

Allocation of Resources Without Limits or Throttling

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers unhandle...

Allocation of Resources Without Limits or Throttling

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling the mux chanList, reached through Dial, NewClientConn, NewControlClientConn, and...

GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

Allocation of Resources Without Limits or Throttling

Overview github.com/golang/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling the mux chanList, reached through Dial, NewClientConn, NewControlClientConn, a...

Allocation of Resources Without Limits or Throttling

Overview github.com/golang/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers...

RLSA-2026:62217 Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...

libssh security update

An update is available for libssh. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...

RLSA-2026:62218 Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings

A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service DoS by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write

A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH Secure Shell channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely,...

golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input

A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial o...