CVE-2026-56855

Published: Sep 2, 2026Modified: Sep 4, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Affected (1)

Products: Golang: Crypto

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Golang Crypto	Before 0.56.0

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://go.dev/cl/826524

Source: security@golang.org

Patch

https://go.dev/issue/81317

Source: security@golang.org

Issue TrackingVendor Advisory

https://groups.google.com/g/golang-announce/c/1y3fb2np35U

Source: security@golang.org

Mailing ListVendor Advisory

https://pkg.go.dev/vuln/GO-2026-6355

Source: security@golang.org

Vendor Advisory

Timeline

No history available yet.