Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by Go

CVE-2026-78662Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

High 7.5

In plain English

A high-severity resource allocation without limits in golang.org/x/crypto/ssh from golang.org/x/crypto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-go.cryptono fix listedDEBIAN-CVE-2026-78662
Debian:13golang-go.cryptono fix listedDEBIAN-CVE-2026-78662
Debian:14golang-go.crypto1:0.56.0-1DEBIAN-CVE-2026-78662
Gogolang.org/x/crypto0.56.0GO-2026-6354
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.10golang-1.26no fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.10golang-1.27no fix listedUBUNTU-CVE-2026-78662
Ubuntu:22.04:LTSgolang-defaultsno fix listedUBUNTU-CVE-2026-78662
Ubuntu:24.04:LTSgolang-defaultsno fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.04:LTSgolang-defaultsno fix listedUBUNTU-CVE-2026-78662
Ubuntu:26.10golang-defaultsno fix listedUBUNTU-CVE-2026-78662

Affected products (as reported)

VendorProductVersions
golang.org/x/crypto golang.org/x/crypto/ssh 0 – before 0.56.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References