{"id":"CVE-2026-56855","title":"golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)","summary":"A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-833","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","confidential_compute_attestation","cryostat 4","external_secrets_operator_for_red_hat_openshift","multicluster_engine_for_kubernetes","openshift_api_for_data_protection","openshift_pipelines","openshift_serverless","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ceph_storage 8","ceph_storage 9","edge_manager 1","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_dev_workspaces_operator","openshift_for_windows_containers","openshift_gitops","openshift_on_aws","openshift_virtualization 4","openstack_platform 16.2","openstack_platform 17.1","openstack_platform 18.0","quay 3","trusted_artifact_signer","security_profiles_operator","zero_trust_workload_identity_manager","zero_trust_workload_identity_manager_tech_preview"],"patched":["golang.org/x/crypto 0.56.0"],"published":"2026-09-02","updated":"2026-09-14","sourceUpdated":"2026-09-14T01:59:33+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56855.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56855.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56855"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528050"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56855"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855"},{"url":"https://go.dev/cl/826524"},{"url":"https://go.dev/issue/81317"},{"url":"https://groups.google.com/g/golang-announce/c/1y3fb2np35U"},{"url":"https://pkg.go.dev/vuln/GO-2026-6355"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00378,"epssPercentile":0.31722,"aliases":["GO-2026-6355"],"ecosystem":"go","ingestedAt":"2026-09-03T19:32:15.779Z","slug":"CVE-2026-56855","body":"## Overview\n\nA flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS) for the affected system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, External Secrets Operator for Red Hat OpenShift, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56855.json)\n\n**golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages** — rated Moderate by Red Hat. Released 2026-09-02, updated 2026-09-14.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Cryostat 4\n- External Secrets Operator for Red Hat OpenShift\n- Multicluster Engine for Kubernetes\n- OpenShift API for Data Protection\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Dev Workspaces Operator\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat OpenShift Virtualization 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n- Red Hat Trusted Artifact Signer\n- Security Profiles Operator\n- Zero Trust Workload Identity Manager\n- Zero Trust Workload Identity Manager - Tech Preview\n\nNo fix planned:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Cryostat 4\n- External Secrets Operator for Red Hat OpenShift\n- Multicluster Engine for Kubernetes\n- OpenShift API for Data Protection\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Dev Workspaces Operator\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat OpenShift Virtualization 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n- Red Hat Trusted Artifact Signer\n- Security Profiles Operator\n- Zero Trust Workload Identity Manager\n- Zero Trust Workload Identity Manager - Tech Preview\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Red Hat is not aware of a practical mitigation that fully prevents this issue while maintaining affected SSH functionality. Where operationally possible, restrict SSH connectivity to trusted systems. Apply relevant Red Hat updates when they become available.\n\n## Package advisory (CVE-2026-56855)\n\nAffected packages:\n\n- `golang.org/x/crypto < 0.56.0`\n\nPatched in:\n\n- `golang.org/x/crypto 0.56.0`\n\nSource: https://osv.dev/vulnerability/GO-2026-6355","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201797,"id":"CVE-2026-56855","ts":1789399725858,"field":"cvss","old":null,"new":"5.3"},{"seq":201796,"id":"CVE-2026-56855","ts":1789399725858,"field":"severity","old":"none","new":"medium"},{"seq":200527,"id":"CVE-2026-56855","ts":1789397373785,"field":"cvss","old":"5.3","new":null},{"seq":200526,"id":"CVE-2026-56855","ts":1789397373785,"field":"severity","old":"medium","new":"none"},{"seq":198444,"id":"CVE-2026-56855","ts":1789391968805,"field":"cvss","old":null,"new":"5.3"},{"seq":198443,"id":"CVE-2026-56855","ts":1789391968805,"field":"severity","old":"none","new":"medium"},{"seq":196237,"id":"CVE-2026-56855","ts":1789383585211,"field":"cvss","old":"5.3","new":null},{"seq":196236,"id":"CVE-2026-56855","ts":1789383585211,"field":"severity","old":"medium","new":"none"},{"seq":195166,"id":"CVE-2026-56855","ts":1789380475055,"field":"cvss","old":null,"new":"5.3"},{"seq":195165,"id":"CVE-2026-56855","ts":1789380475055,"field":"severity","old":"none","new":"medium"},{"seq":193953,"id":"CVE-2026-56855","ts":1789378515615,"field":"cvss","old":"5.3","new":null},{"seq":193952,"id":"CVE-2026-56855","ts":1789378515615,"field":"severity","old":"medium","new":"none"},{"seq":192740,"id":"CVE-2026-56855","ts":1789376407141,"field":"cvss","old":null,"new":"5.3"},{"seq":192739,"id":"CVE-2026-56855","ts":1789376407141,"field":"severity","old":"none","new":"medium"},{"seq":191527,"id":"CVE-2026-56855","ts":1789373419697,"field":"cvss","old":"5.3","new":null},{"seq":191526,"id":"CVE-2026-56855","ts":1789373419697,"field":"severity","old":"medium","new":"none"},{"seq":190312,"id":"CVE-2026-56855","ts":1789369300007,"field":"cvss","old":null,"new":"5.3"},{"seq":190311,"id":"CVE-2026-56855","ts":1789369300007,"field":"severity","old":"none","new":"medium"},{"seq":189099,"id":"CVE-2026-56855","ts":1789368266967,"field":"cvss","old":"5.3","new":null},{"seq":189098,"id":"CVE-2026-56855","ts":1789368266967,"field":"severity","old":"medium","new":"none"},{"seq":187882,"id":"CVE-2026-56855","ts":1789365143354,"field":"cvss","old":null,"new":"5.3"},{"seq":187881,"id":"CVE-2026-56855","ts":1789365143354,"field":"severity","old":"none","new":"medium"},{"seq":186669,"id":"CVE-2026-56855","ts":1789363271406,"field":"cvss","old":"5.3","new":null},{"seq":186668,"id":"CVE-2026-56855","ts":1789363271406,"field":"severity","old":"medium","new":"none"},{"seq":185455,"id":"CVE-2026-56855","ts":1789361101334,"field":"cvss","old":null,"new":"5.3"},{"seq":185454,"id":"CVE-2026-56855","ts":1789361101334,"field":"severity","old":"none","new":"medium"},{"seq":184242,"id":"CVE-2026-56855","ts":1789358155668,"field":"cvss","old":"5.3","new":null},{"seq":184241,"id":"CVE-2026-56855","ts":1789358155668,"field":"severity","old":"medium","new":"none"},{"seq":182493,"id":"CVE-2026-56855","ts":1789354222473,"field":"cvss","old":null,"new":"5.3"},{"seq":182492,"id":"CVE-2026-56855","ts":1789354222473,"field":"severity","old":"none","new":"medium"},{"seq":181286,"id":"CVE-2026-56855","ts":1789353120610,"field":"cvss","old":"5.3","new":null},{"seq":181285,"id":"CVE-2026-56855","ts":1789353120610,"field":"severity","old":"medium","new":"none"},{"seq":180079,"id":"CVE-2026-56855","ts":1789350169126,"field":"cvss","old":null,"new":"5.3"},{"seq":180078,"id":"CVE-2026-56855","ts":1789350169126,"field":"severity","old":"none","new":"medium"},{"seq":178872,"id":"CVE-2026-56855","ts":1789348101411,"field":"cvss","old":"5.3","new":null},{"seq":178871,"id":"CVE-2026-56855","ts":1789348101411,"field":"severity","old":"medium","new":"none"},{"seq":177665,"id":"CVE-2026-56855","ts":1789346277623,"field":"cvss","old":null,"new":"5.3"},{"seq":177664,"id":"CVE-2026-56855","ts":1789346277623,"field":"severity","old":"none","new":"medium"},{"seq":176458,"id":"CVE-2026-56855","ts":1789343018781,"field":"cvss","old":"5.3","new":null},{"seq":176457,"id":"CVE-2026-56855","ts":1789343018781,"field":"severity","old":"medium","new":"none"},{"seq":174575,"id":"CVE-2026-56855","ts":1789334771619,"field":"cvss","old":null,"new":"5.3"},{"seq":174574,"id":"CVE-2026-56855","ts":1789334771619,"field":"severity","old":"none","new":"medium"},{"seq":173370,"id":"CVE-2026-56855","ts":1789333512388,"field":"cvss","old":"5.3","new":null},{"seq":173369,"id":"CVE-2026-56855","ts":1789333512388,"field":"severity","old":"medium","new":"none"},{"seq":172184,"id":"CVE-2026-56855","ts":1789331018051,"field":"cvss","old":null,"new":"5.3"},{"seq":172183,"id":"CVE-2026-56855","ts":1789331018051,"field":"severity","old":"none","new":"medium"},{"seq":170998,"id":"CVE-2026-56855","ts":1789328614594,"field":"cvss","old":"5.3","new":null},{"seq":170997,"id":"CVE-2026-56855","ts":1789328614594,"field":"severity","old":"medium","new":"none"},{"seq":169793,"id":"CVE-2026-56855","ts":1789327051000,"field":"cvss","old":null,"new":"5.3"},{"seq":169792,"id":"CVE-2026-56855","ts":1789327051000,"field":"severity","old":"none","new":"medium"}]}