CVE-2026-56855: 
Docker vulnerability analysis and mitigation

CVE-2026-56855 is a Denial of Service vulnerability in the golang.org/x/crypto/ssh package that allows a malicious peer to send crafted RFC 4254 channel messages after a channel has been established, causing the entire SSH connection to deadlock. All versions of golang.org/x/crypto prior to 0.56.0 are affected. The vulnerability was published on September 2, 2026, with a patch released on September 7, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, OSV).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the SSH implementation in golang.org/x/crypto/ssh did not fully handle all RFC 4254 channel messages and global requests. When an unrecognized message was received, it was buffered rather than rejected, causing the connection goroutine to block indefinitely — a deadlock condition. The fix ensures all RFC 4254 channel messages are handled explicitly, and any unrecognized messages are treated as protocol errors that tear down the connection rather than being buffered. No authentication is required to exploit this; an attacker only needs to establish an SSH channel with a vulnerable server or client (OSV, Go Issue).

Successful exploitation results in a complete denial of service for the affected SSH connection — all communication on the deadlocked connection becomes permanently unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Any application using golang.org/x/crypto/ssh as an SSH server or client (including tools like rclone and Portainer) is potentially affected, and repeated exploitation could exhaust connection resources on the target system (Feedly, OSV).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable. The EPSS score is approximately 0.17%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, OSV).

1. Identify target: Locate a service or application using golang.org/x/crypto/ssh versions prior to 0.56.0 as an SSH server or client (e.g., via banner grabbing or version enumeration).
2. Establish SSH channel: Complete the SSH handshake and open a channel with the target to satisfy the precondition that a channel must be established before the attack can proceed.
3. Send crafted message: Transmit a specially crafted SSH message that conforms to an unrecognized RFC 4254 channel message type — one that the vulnerable implementation does not handle and will buffer instead of reject.
4. Trigger deadlock: The vulnerable SSH implementation buffers the unrecognized message and blocks, causing the connection goroutine to deadlock and rendering the entire connection unresponsive.
5. Repeat for impact: Repeat the process across multiple connections to exhaust server resources or persistently deny service to legitimate users (OSV, Go Issue).

• Network: Unusual or persistent SSH connections that remain open but transfer no data; connections from unexpected source IPs that establish a channel and then go silent.
• Logs: SSH server logs showing established channels with no subsequent activity or graceful closure; application logs showing goroutine or connection handler hangs.
• Process: Go application processes consuming elevated CPU or memory due to blocked goroutines; connection handler threads stuck in a blocked/waiting state with no progress.
• Application Behavior: SSH-dependent services becoming unresponsive or timing out despite the underlying TCP connection remaining open (OSV).

The primary remediation is to upgrade golang.org/x/crypto to version 0.56.0 or later, which properly handles all RFC 4254 channel messages and tears down connections on protocol errors instead of buffering them. Downstream projects such as rclone and Portainer have released updated versions incorporating the fix and should also be updated. As a temporary network-level workaround, implement rate limiting and connection throttling on SSH endpoints to reduce exposure to repeated deadlock attempts, and monitor for anomalous connection patterns (OSV, Go CL, SUSE Advisory).

The vulnerability was covered in BleepingComputer's September 2026 Patch Tuesday roundup, which noted Microsoft's advisory inclusion. OpenSUSE and SUSE issued multiple security announcements addressing the vulnerability in their distributions. The Go security team disclosed the issue via the golang-announce mailing list and published a detailed entry in the Go vulnerability database (BleepingComputer, openSUSE Announce, golang-announce).