CVE-2026-56855

A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS) for the affected system.

A malicious SSH peer can send crafted channel messages after a connection is established, causing the affected SSH connection to become unresponsive. This vulnerability does not affect confidentiality or integrity. Red Hat rates this issue as Moderate because the demonstrated availability impact is limited to the affected connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical mitigation that fully prevents this issue while maintaining affected SSH functionality. Where operationally possible, restrict SSH connectivity to trusted systems. Apply relevant Red Hat updates when they become available.