golang.org/x/crypto CVE-2026-56855

Exploitation requires that an SSH channel has already been established between the victim application and the malicious peer - this means the SSH transport and, for server-side exploitation, authentication must have completed. In the client-attack scenario (malicious server targeting a vulnerable client), the attacker needs no credentials; the connecting client only needs to reach the attacker-controlled server and complete the key exchange. In the server-attack scenario (malicious client targeting a vulnerable server), the attacker must first authenticate to the server, limiting exploitation to credential holders or misconfigured servers permitting anonymous access. The vulnerability is not configuration-dependent beyond the library being used for SSH - it triggers against the default message-handling path. Impact is limited to availability (connection deadlock); no elevation of privilege or data disclosure is possible through this path alone.

CVSS 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects the worst-case scenario: an attacker operating a malicious SSH server can deadlock any connecting client using the vulnerable library without requiring authentication on the attacker's side. When exploitation flows the other direction - an attacker as SSH client against a vulnerable server - some level of authentication is typically required, which would raise effective AC and PR. EPSS stands at 0.17% (7th percentile), indicating low predicted exploitation probability in the short term. There is no CISA KEV listing and no public POC at time of analysis. The library is foundational to large swaths of the Go ecosystem (Kubernetes, many cloud-native tools), meaning the blast radius from widespread exploitation would be high even though the probability signal is currently low. The impact is purely availability - no confidentiality or integrity compromise. Overall this is a real operational risk for internet-facing Go SSH servers and clients, justified by the large deployment footprint, but not an emergency given the absence of active exploitation and the straightforward upgrade path.

An attacker stands up a malicious SSH server and advertises it at a network location reachable by a victim application using a vulnerable version of golang.org/x/crypto/ssh. When the victim client connects and a channel is established, the malicious server sends a crafted sequence of RFC 4254 channel messages containing unrecognised types. The client library buffers these messages indefinitely, causing the connection goroutine to deadlock, rendering the connection permanently unavailable and potentially starving the application of SSH connectivity.