CVE-2026-56855: 
Terraform Community vulnerability analysis and mitigation

CVE-2026-56855 is a denial-of-service vulnerability in the golang.org/x/crypto/ssh package that allows a malicious SSH peer to deadlock an entire connection by sending crafted channel messages. After a channel is established, the affected implementation would buffer and block on unhandled RFC 4254 messages rather than treating them as protocol errors, enabling a remote attacker to freeze the connection. All versions of golang.org/x/crypto/ssh prior to 0.56.0 are affected. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, OSV).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When an SSH channel was established, the library did not fully handle all RFC 4254 channel message types — global requests were not explicitly processed, and unrecognized messages were silently buffered rather than rejected. A malicious peer could exploit this by sending crafted, unexpected channel messages that caused the connection goroutine to block indefinitely, deadlocking the entire SSH connection. The fix ensures all RFC 4254 channel messages are handled, global requests are processed explicitly, and any remaining unrecognized messages trigger a protocol error that tears down the connection (OSV, Go Issue, Go CL).

Successful exploitation results in a complete denial of service for the affected SSH connection, with high availability impact and no confidentiality or integrity impact. An unauthenticated remote attacker can deadlock any SSH connection handled by the vulnerable library, potentially rendering SSH-dependent services unresponsive. Applications and services built on golang.org/x/crypto/ssh — including custom SSH servers and clients — are at risk of connection-level resource exhaustion (Feedly, OSV).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment indicates no known exploitation and classifies the vulnerability as automatable with partial technical impact. The EPSS score is approximately 0.0017 (0.17%), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, OSV).

1. Identify target: Locate services or applications using golang.org/x/crypto/ssh versions prior to 0.56.0 as an SSH server or client (e.g., custom Go-based SSH servers).
2. Establish SSH channel: Complete the SSH handshake and open a channel with the target service to reach the vulnerable post-channel-establishment state.
3. Send crafted messages: Transmit RFC 4254 channel messages of types not explicitly handled by the library (e.g., unrecognized global request types or unexpected channel message types).
4. Trigger deadlock: The server's connection goroutine attempts to buffer the unhandled messages and blocks indefinitely, deadlocking the entire SSH connection and making the service unresponsive to further requests (OSV, Go Issue).

• Network: Persistent, long-lived SSH connections from unexpected or unknown source IPs that do not complete normal session activity.
• Process: Go application processes with SSH connection goroutines stuck in a blocked/waiting state; elevated goroutine counts in Go runtime metrics.
• Logs: SSH connection logs showing sessions that opened channels but never completed or terminated normally; absence of session close events following channel open events.
• Availability: Sudden unresponsiveness of SSH-based Go services without corresponding crash logs or OS-level errors.

Upgrade golang.org/x/crypto to version 0.56.0 or later, which includes the fix that properly handles all RFC 4254 channel messages and tears down connections on protocol errors instead of blocking. Developers should update their go.mod dependencies and rebuild affected applications. No configuration-based workaround is available; patching is the only remediation (OSV, Go CL, golang-announce).

The vulnerability was announced via the golang-announce mailing list and tracked in the Go vulnerability database. Community discussion has been limited, consistent with the moderate severity and narrow scope of the issue. No notable vendor statements or significant media coverage beyond standard vulnerability aggregator listings have been observed (golang-announce, OSV).