Vulnerability Description
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Crypto | < 0.56.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/826524Patch
- https://go.dev/issue/81317Issue TrackingVendor Advisory
- https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing ListVendor Advisory
- https://pkg.go.dev/vuln/GO-2026-6355Vendor Advisory
FAQ
What is CVE-2026-56855?
CVE-2026-56855 is a vulnerability with a CVSS score of 7.5 (HIGH). Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests ...
How severe is CVE-2026-56855?
CVE-2026-56855 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56855?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Crypto.