---
id: CVE-2026-78662
title: >-
  golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via
  channel request flooding (CVE-2026-78662)
summary: >-
  A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could
  flood a channel's incoming requests before it is established, leading to a
  deadlock of the entire connection. This could result in a denial of service
  (DoS) for…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-833
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - assisted_installer_for_red_hat_openshift_container_platform 2
  - builds_for_red_hat_openshift
  - cert_manager_operator_for_red_hat_openshift
  - confidential_compute_attestation
  - cryostat 4
  - external_secrets_operator_for_red_hat_openshift
  - multicluster_engine_for_kubernetes
  - openshift_api_for_data_protection
  - openshift_pipelines
  - openshift_serverless
  - advanced_cluster_management_for_kubernetes 2
  - advanced_cluster_security 4
  - ceph_storage 8
  - ceph_storage 9
  - edge_manager 1
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_data_foundation 4
  - openshift_dev_spaces
  - openshift_dev_workspaces_operator
  - openshift_for_windows_containers
  - openshift_gitops
  - openshift_on_aws
  - openshift_virtualization 4
  - openstack_platform 16.2
  - openstack_platform 17.1
  - openstack_platform 18.0
  - quay 3
  - trusted_artifact_signer
  - security_profiles_operator
  - zero_trust_workload_identity_manager
  - zero_trust_workload_identity_manager_tech_preview
patched:
  - golang.org/x/crypto 0.56.0
published: '2026-09-02'
updated: '2026-09-12'
sourceUpdated: '2026-09-12T09:00:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78662.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78662.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-78662'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528026'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-78662'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78662'
  - url: 'https://go.dev/cl/826504'
  - url: 'https://go.dev/issue/81316'
  - url: 'https://groups.google.com/g/golang-announce/c/1y3fb2np35U'
  - url: 'https://pkg.go.dev/vuln/GO-2026-6354'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00431
epssPercentile: 0.34741
aliases:
  - GO-2026-6354
ecosystem: go
ingestedAt: '2026-09-03T19:32:15.737Z'
---

## Overview

A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for legitimate users.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, External Secrets Operator for Red Hat OpenShift, … · no fix planned: Red Hat Ceph Storage 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, … · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78662.json)

**golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding** — rated Moderate by Red Hat. Released 2026-09-02, updated 2026-09-12.

Affected:

- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Confidential Compute Attestation
- Cryostat 4
- External Secrets Operator for Red Hat OpenShift
- Multicluster Engine for Kubernetes
- OpenShift API for Data Protection
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Workspaces Operator
- Red Hat OpenShift for Windows Containers
- Red Hat OpenShift GitOps
- Red Hat OpenShift on AWS
- Red Hat OpenShift Virtualization 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3
- Red Hat Trusted Artifact Signer
- Security Profiles Operator
- Zero Trust Workload Identity Manager
- Zero Trust Workload Identity Manager - Tech Preview

No fix planned:

- Red Hat Ceph Storage 9
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Confidential Compute Attestation
- Cryostat 4
- External Secrets Operator for Red Hat OpenShift
- Multicluster Engine for Kubernetes
- OpenShift API for Data Protection
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ceph Storage 8
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Workspaces Operator
- Red Hat OpenShift for Windows Containers
- Red Hat OpenShift GitOps
- Red Hat OpenShift on AWS
- Red Hat OpenShift Virtualization 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3
- Red Hat Trusted Artifact Signer
- Security Profiles Operator
- Zero Trust Workload Identity Manager
- Zero Trust Workload Identity Manager - Tech Preview

## Remediation

Out of support scope

Workarounds / mitigations:

- Red Hat is not aware of a practical mitigation that fully prevents this issue while maintaining affected SSH functionality. Where operationally possible, restrict SSH connectivity to trusted systems. Apply relevant Red Hat updates when they become available.

## Package advisory (CVE-2026-78662)

Affected packages:

- `golang.org/x/crypto < 0.56.0`

Patched in:

- `golang.org/x/crypto 0.56.0`

Source: https://osv.dev/vulnerability/GO-2026-6354