High · 7.5 CVE-2026-56855 EUVD-2026-70267GO-2026-6355

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Published Sep 2, 2026 · Updated Sep 3, 2026 · Assigned by Go

Vendor: golang.org/x/crypto Product: golang.org/x/crypto/ssh Package: aactl Package: act Package: apko Package: argo-cd-3.2 Package: argo-cd-3.2-compat Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-events Package: argo-workflow-executor-3.7 Package: argo-workflow-executor-4.0 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: argocd-image-updater Package: bento Package: buildah Package: buildkitd Package: cerbos Package: cerbosctl Package: cert-manager Package: cert-manager-1.20 Package: cert-manager-1.20-crds Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cf-cli Package: chezmoi Package: chisel Package: cilium-1.19 Package: cilium-1.19-operator-generic Package: cilium-cli Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: cri-o Package: crossplane-2.2-crank Package: dagger Package: dapr-daprd-1.17 Package: datadog-agent-7.77 Package: datadog-agent-7.78 Package: datadog-agent-7.79 Package: datadog-agent-7.80 Package: datadog-agent-7.81 Package: datadog-agent-7.81-full Package: docker-buildx Package: docker-cli-buildx Package: docker-compose Package: docker-config-mirror-gcr-28 Package: docker-dind-compat-28 Package: dockerd-28 Package: dockerd-29 Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: external-secrets-operator-2.6 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: flux-image-automation-controller Package: flux-notification-controller Package: flux-source-controller Package: frp Package: fscrypt Package: gatus Package: gh Package: gh Package: gitaly-19.1 Package: gitea Package: gitlab-docker-machine-19.1 Package: gitlab-docker-machine-19.2 Package: gitlab-docker-machine-19.3 Package: gitlab-kas-19.3 Package: gitlab-runner-19.1 Package: gitlab-runner-19.2 Package: gitlab-runner-19.3 Package: gitlab-runner-helper-19.1 Package: gitlab-runner-helper-19.2 Package: gitlab-runner-helper-19.3 Package: gitness Package: gitsign Package: golang-1.17 Package: golang-1.20 Package: golang-1.21 Package: golang-1.23 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.27 Package: golang-defaults Package: golang-go.crypto Package: golang.org/x/crypto Package: gomplate-5 Package: goreleaser Package: gptscript Package: grafana-alloy Package: grype Package: guac Package: guacingest Package: guacone Package: helm-3 Package: juicefs-1.3 Package: k3s Package: k3s-1.32 Package: k3s-1.34 Package: k3s-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k9s Package: kaf Package: kaniko Package: kine Package: kots Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubescape Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevirt Package: kubevirt-openvmm Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: libcontainers-common Package: litestream Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: melange Package: minio Package: moby-engine Package: nerdctl Package: nfpm Package: nuclei Package: nvidia-container-toolkit Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: opentofu-1.11 Package: opentofu-1.12 Package: opentofu-1.12-compat Package: opentofu-1.9 Package: osv-scanner Package: packer Package: podman Package: podman-6.0 Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-java Package: pulumi-language-yaml Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-fleet Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-machine Package: rclone Package: rootlesskit Package: ruby3.3-fluent-plugin-grafana-loki-3.7 Package: scorecard Package: seaweedfs Package: sftpgo Package: skaffold Package: snyk-cli Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: syft Package: tailscale Package: telegraf Package: telegraf-1.38 Package: terraform Package: tfsec Package: trivy Package: trivy-operator Package: trufflehog Package: wal-g-pg Package: witness Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Affected products

Vendor	Product	Affected	Fixed
golang.org/x/crypto	golang.org/x/crypto/ssh	< 0.56.0	0.56.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-go.crypto	1:0.56.0-1	—
Debian 13	golang-go.crypto	No fix yet	—
Debian 12	golang-go.crypto	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	golang-1.26 +2	No fix yet	—
Ubuntu 26.04 LTS	golang-1.23 +3	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 20.04 LTS	golang-1.20 +2	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-defaults	No fix yet	—
Ubuntu 16.04 LTS	golang-defaults	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	buildah +1	2:1.43.3-2.el9_8	RHSA-2026:90424, RHSA-2026:70640

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	buildah +1	2:1.43.3-2.el9_8	ALSA-2026:90424, ALSA-2026:70640

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	buildah	2:1.43.3-2.el9_8	RLSA-2026:90424, RLSA-2026:70640

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	alloy	1.19.2-150700.15.29.1	SUSE-SU-2026:4408-1
SLES 15 SP7	amazon-ssm-agent	3.3.5390.0-150000.5.43.1	SUSE-SU-2026:4372-1
SLES 15 SP7	apptainer	1.5.3-150600.4.43.1	SUSE-SU-2026:4308-1
SLES 15 SP7	containerized-data-importer	1.64.0-150700.9.14.1	SUSE-SU-2026:4209-1
SLES 15 SP7	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES 15 SP7	google-guest-agent	20260903.01-150000.1.85.1	SUSE-SU-2026:4270-1
SLES 15 SP7	google-osconfig-agent	20260911.00-150000.1.67.1	SUSE-SU-2026:4293-1
SLES 15 SP7	kubevirt	1.7.4-150700.3.42.1	SUSE-SU-2026:5167-1
SLES 15 SP6	amazon-ssm-agent	3.3.5390.0-150000.5.43.1	SUSE-SU-2026:4372-1
SLES 15 SP6	apptainer	1.5.3-150600.4.43.1	SUSE-SU-2026:4308-1
SLES 15 SP6	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES 15 SP6	google-guest-agent	20260903.01-150000.1.85.1	SUSE-SU-2026:4270-1
SLES 15 SP6	google-osconfig-agent	20260911.00-150000.1.67.1	SUSE-SU-2026:4293-1
SLES 15 SP5	amazon-ssm-agent	3.3.5390.0-150000.5.43.1	SUSE-SU-2026:4372-1
SLES 15 SP5	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES 15 SP5	google-guest-agent	20260903.01-150000.1.85.1	SUSE-SU-2026:4270-1
SLES 15 SP5	google-osconfig-agent	20260911.00-150000.1.67.1	SUSE-SU-2026:4293-1
SLES 15 SP5	terraform-provider-aws	3.11.0-150200.6.29.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-azurerm	2.32.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-external	2.0.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-google	3.43.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-helm	2.9.0-150200.6.34.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-kubernetes	1.13.2-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-local	2.0.0-150200.6.30.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-null	3.0.0-150200.6.32.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-random	3.0.0-150200.6.26.2	SUSE-SU-2026:4628-1
SLES 15 SP5	terraform-provider-tls	3.0.0-150200.5.26.2	SUSE-SU-2026:4628-1
SLES 15 SP4	amazon-ssm-agent	3.3.5390.0-150000.5.43.1	SUSE-SU-2026:4372-1
SLES 15 SP4	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES 15 SP4	google-guest-agent	20260903.01-150000.1.85.1	SUSE-SU-2026:4270-1
SLES 15 SP4	google-osconfig-agent	20260911.00-150000.1.67.1	SUSE-SU-2026:4293-1
SLES 15 SP4	terraform-provider-aws	3.11.0-150200.6.29.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-azurerm	2.32.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-external	2.0.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-google	3.43.0-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-helm	2.9.0-150200.6.34.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-kubernetes	1.13.2-150200.6.23.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-local	2.0.0-150200.6.30.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-null	3.0.0-150200.6.32.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-random	3.0.0-150200.6.26.2	SUSE-SU-2026:4628-1
SLES 15 SP4	terraform-provider-tls	3.0.0-150200.5.26.2	SUSE-SU-2026:4628-1
SLES 12	amazon-ssm-agent	3.3.5390.0-4.52.1	SUSE-SU-2026:4286-1
SLES 12	google-guest-agent	20260903.01-1.75.1	SUSE-SU-2026:4272-1
SLES 12	google-osconfig-agent	20260911.00-1.60.1	SUSE-SU-2026:4292-1

Show 11 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	alloy	1.19.2-160000.1.1	SUSE-SU-2026:24148-1
SLES for SAP 16.0	cosign	3.1.3-160000.1.1	SUSE-SU-2026:24213-1
SLES for SAP 16.0	govulncheck-vulndb	0.0.20260902T191204-160000.1.1	SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
SLES for SAP 16.0	helm	4.3.0-160000.1.1	SUSE-SU-2026:23984-1
SLES for SAP 15 SP6	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES for SAP 15 SP5	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES for SAP 15 SP4	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLES 16.0	alloy	1.19.2-160000.1.1	SUSE-SU-2026:24148-1
SLES 16.0	cosign	3.1.3-160000.1.1	SUSE-SU-2026:24213-1
SLES 16.0	govulncheck-vulndb	0.0.20260902T191204-160000.1.1	SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
SLES 16.0	helm	4.3.0-160000.1.1	SUSE-SU-2026:23984-1
SLE Micro 6.2	helm	4.3.0-160000.1.1	SUSE-SU-2026:23973-1
SLE Micro 6.1	google-guest-agent	20260903.01-slfo.1.1_1.1	SUSE-SU-2026:23745-1, SUSE-SU-2026:23736-1
SLE Micro 6.1	google-osconfig-agent	20260908.00-slfo.1.1_1.1	SUSE-SU-2026:23924-1, SUSE-SU-2026:23739-1
SLE Micro 6.1	helm	4.3.0-slfo.1.1_1.1	SUSE-SU-2026:24282-1
SLE Micro 6.0	google-guest-agent	20260903.01-1.1	SUSE-SU-2026:23874-1, SUSE-SU-2026:23831-1
SLE Micro 6.0	google-osconfig-agent	20260908.00-2.1	SUSE-SU-2026:23876-1, SUSE-SU-2026:23841-1
SLE Micro 5.5	google-guest-agent	20260903.01-150000.1.85.1	SUSE-SU-2026:4270-1
SLE Micro 5.5	google-osconfig-agent	20260911.00-150000.1.67.1	SUSE-SU-2026:4293-1
SLE HPC 15 SP5	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1
SLE HPC 15 SP4	cosign	3.1.3-150400.3.57.1	SUSE-SU-2026:4392-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	containerized-data-importer1.65	1.65.0-3.1	openSUSE-SU-2026:11731-1
openSUSE Tumbleweed	containerized-data-importer1.66	1.66.1-1.1	openSUSE-SU-2026:11732-1
openSUSE Tumbleweed	cosign	3.1.3-1.1	openSUSE-SU-2026:11871-1
openSUSE Tumbleweed	gh	2.100.0-1.1	openSUSE-SU-2026:11698-1
openSUSE Tumbleweed	git-bug	0.10.1-7.1	openSUSE-SU-2026:11717-1
openSUSE Tumbleweed	gitea-tea	0.16.0-1.1	openSUSE-SU-2026:11772-1
openSUSE Tumbleweed	grafana	12.4.11-1.1	openSUSE-SU-2026:11920-1
openSUSE Tumbleweed	hauler	2.1.0-2.1	openSUSE-SU-2026:11685-1
openSUSE Tumbleweed	helm	4.3.0-1.1	openSUSE-SU-2026:11820-1
openSUSE Tumbleweed	keybase-client	6.6.3-4.1	openSUSE-SU-2026:11704-1
openSUSE Tumbleweed	kubevirt1.9	1.9.0-3.1	openSUSE-SU-2026:11752-1
openSUSE Tumbleweed	rclone	1.75.1-1.1	openSUSE-SU-2026:11727-1
openSUSE Tumbleweed	trivy	0.74.0-3.1	openSUSE-SU-2026:11691-1
openSUSE Tumbleweed	zk	0.15.7-1.1	openSUSE-SU-2026:12258-1
openSUSE Leap 16.0	alloy	1.19.2-160000.1.1	openSUSE-SU-2026:22032-1
openSUSE Leap 16.0	amazon-ssm-agent	3.3.5390.0-160000.1.1	openSUSE-SU-2026:21884-1
openSUSE Leap 16.0	apptainer	1.5.3-bp160.4.1	openSUSE-SU-2026:21927-1
openSUSE Leap 16.0	cloudflared	2026.9.1-bp160.1.1	openSUSE-SU-2026:21924-1
openSUSE Leap 16.0	containerized-data-importer1.65	1.65.0-160000.3.1	openSUSE-SU-2026:21824-1
openSUSE Leap 16.0	cosign	3.1.3-160000.1.1	openSUSE-SU-2026:22064-1
openSUSE Leap 16.0	gh	2.100.0-bp160.1.1	openSUSE-SU-2026:21861-1
openSUSE Leap 16.0	google-guest-agent	20260903.01-160000.1.1	openSUSE-SU-2026:21879-1
openSUSE Leap 16.0	google-osconfig-agent	20260911.00-160000.1.1	openSUSE-SU-2026:21882-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260902T191204-160000.1.1	openSUSE-SU-2026:21812-1
openSUSE Leap 16.0	hauler	2.1.0-bp160.2.1	openSUSE-SU-2026:21841-1, openSUSE-SU-2026:21816-1
openSUSE Leap 16.0	helm	4.3.0-160000.1.1	openSUSE-SU-2026:21983-1
openSUSE Leap 16.0	keybase-client	6.6.3-bp160.3.1	openSUSE-SU-2026:21846-1
openSUSE Leap 16.0	rclone	1.75.1-bp160.1.1	openSUSE-SU-2026:21999-1
openSUSE Leap 16.0	trivy	0.74.0-160000.2.1	openSUSE-SU-2026:21835-1, openSUSE-SU-2026:21801-1
openSUSE Leap 16.0	zk	0.15.6-bp160.2.1	openSUSE-SU-2026:21814-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-ssm-agent	3.3.5390.0-1.amzn2023	ALAS2023-2026-3160
Amazon Linux 2023	buildah	2:1.43.1-1.amzn2023.0.2	ALAS2023-2026-3256
Amazon Linux 2023	containerd +1	2.3.7-1.amzn2023.0.1	ALAS2023-2026-3273
Amazon Linux 2023	docker	25.0.18-1.amzn2023.0.1	ALAS2023-2026-3266
Amazon Linux 2023	nerdctl	2.3.5-1.amzn2023.0.2	ALAS2023-2026-3274
Amazon Linux 2023	rclone	1.75.1-1.amzn2023	ALAS2023-2026-3129
Amazon Linux 2023	runfinch-finch	1.19.0-1.amzn2023.0.1	ALAS2023-2026-3140
Amazon Linux 2023	skopeo +1	2:1.22.2-1.amzn2023.0.2	ALAS2023-2026-3254
Amazon Linux 2	amazon-ssm-agent	3.3.5390.0-1.amzn2	ALAS2-2026-3969
Amazon Linux 2	nerdctl	2.3.5-1.amzn2.0.2	ALAS2-2026-4018

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	cert-manager	1.12.15-14	—
Azure Linux 3	cf-cli	8.7.11-9	—
Azure Linux 3	cri-o +5	No fix yet	—
Azure Linux 3	docker-buildx	0.14.0-17	—
Azure Linux 3	docker-compose	2.27.0-14	—
Azure Linux 3	gh	2.101.0-1	—
Azure Linux 3	kubernetes	1.30.10-30	—
Azure Linux 3	kubevirt	1.8.4-2	—
Azure Linux 3	moby-engine	25.0.18-1	—
Azure Linux 3	packer	1.9.5-21	—
Azure Linux 3	telegraf	1.31.0-33	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	buildah +1	2:1.43.3-2.0.1.el9_8	ELSA-2026-90424, ELSA-2026-70640

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	aactl	0.4.12-r75	—
Wolfi rolling	act	0.2.89-r10	—
Wolfi rolling	apko	1.2.43-r3	—
Wolfi rolling	argo-cd-3.2 +1	3.2.12-r19	—
Wolfi rolling	argo-cd-3.3 +1	3.3.14-r8	—
Wolfi rolling	argo-cd-3.4 +1	3.4.8-r2	—
Wolfi rolling	argo-events	1.9.11-r10	—
Wolfi rolling	argo-workflows-3.7 +1	3.7.18-r6	—
Wolfi rolling	argo-workflows-4.0 +1	4.0.10-r5	—
Wolfi rolling	argocd-image-updater	1.3.0-r8	—
Wolfi rolling	bento	1.21.1-r6	—
Wolfi rolling	buildkitd	0.33.0-r1	—
Wolfi rolling	cerbos +1	0.55.0-r6	—
Wolfi rolling	cert-manager-1.20 +4	1.20.3-r17	—
Wolfi rolling	cert-manager-1.20-crds	1.20.3-r18	—
Wolfi rolling	chezmoi	2.72.1-r2	—
Wolfi rolling	chisel	1.12.0-r2	—
Wolfi rolling	cilium-1.19	1.19.7-r6	—
Wolfi rolling	cilium-1.19-operator-generic	1.19.7-r7	—
Wolfi rolling	cilium-cli	0.20.0-r3	—
Wolfi rolling	containerd-1	1.7.34-r14	—
Wolfi rolling	containerd-2	2.3.5-r0	—
Wolfi rolling	containerd-2.3	2.3.4-r10	—
Wolfi rolling	crossplane-2.2-crank	2.2.5-r3	—
Wolfi rolling	dagger	0.20.8-r21	—
Wolfi rolling	dapr-daprd-1.17	1.17.13-r6	—
Wolfi rolling	datadog-agent-7.78	7.78.4-r20	—
Wolfi rolling	datadog-agent-7.79	7.79.2-r18	—
Wolfi rolling	datadog-agent-7.80	7.80.4-r16	—
Wolfi rolling	datadog-agent-7.81 +1	7.81.3-r5	—
Wolfi rolling	docker-cli-buildx	0.37.0-r1	—
Wolfi rolling	docker-dind-compat-28 +1	28.5.2-r38	—
Wolfi rolling	dockerd-28	28.5.2-r37	—
Wolfi rolling	dockerd-29	29.7.2-r8	—
Wolfi rolling	external-dns-0.21	0.21.0-r24	—
Wolfi rolling	external-secrets-operator-2.3	2.3.0-r22	—
Wolfi rolling	external-secrets-operator-2.4	2.4.1-r18	—
Wolfi rolling	external-secrets-operator-2.5	2.5.0-r15	—
Wolfi rolling	external-secrets-operator-2.6	2.6.0-r12	—
Wolfi rolling	falco-no-driver	0.44.1-r9	—
Wolfi rolling	flux-2.7	2.7.5-r38	—
Wolfi rolling	flux-2.8	2.8.8-r21	—
Wolfi rolling	flux-2.9	2.9.5-r3	—
Wolfi rolling	flux-image-automation-controller	1.2.5-r2	—
Wolfi rolling	flux-notification-controller	1.9.4-r3	—
Wolfi rolling	flux-source-controller	1.9.5-r4	—
Wolfi rolling	frp	0.71.0-r5	—
Wolfi rolling	fscrypt	0.3.7-r4	—
Wolfi rolling	gatus	5.36.0-r14	—
Wolfi rolling	gh	2.100.0-r0	—
Wolfi rolling	gitaly-19.1	19.1.7-r2	—
Wolfi rolling	gitea	1.27.3-r4	—
Wolfi rolling	gitlab-kas-19.3 +3	19.3.1-r3	—
Wolfi rolling	gitlab-runner-19.1 +2	19.1.2-r8	—
Wolfi rolling	gitlab-runner-19.2 +2	19.2.3-r3	—
Wolfi rolling	gitness	3.3.0-r36	—
Wolfi rolling	gitsign	0.17.1-r7	—
Wolfi rolling	gomplate-5	5.2.0-r9	—
Wolfi rolling	goreleaser	2.18.0-r3	—
Wolfi rolling	gptscript	0.9.9-r447	—
Wolfi rolling	grafana-alloy	1.19.2-r4	—
Wolfi rolling	grype	0.118.0-r2	—
Wolfi rolling	guac +2	1.1.0-r32	—
Wolfi rolling	helm-3	3.21.4-r5	—
Wolfi rolling	juicefs-1.3	1.3.3-r6	—
Wolfi rolling	k3s +1	1.36.4.1-r4	—
Wolfi rolling	k3s-1.32 +2	No fix yet	—
Wolfi rolling	k3s-1.34 +1	1.34.11.1-r3	—
Wolfi rolling	k3s-1.35 +1	1.35.8.1-r6	—
Wolfi rolling	k9s	0.51.0-r17	—
Wolfi rolling	kaf	0.2.14-r16	—
Wolfi rolling	kaniko	1.25.19-r3	—
Wolfi rolling	kine	0.17.0-r3	—
Wolfi rolling	kots	1.131.7-r0	—
Wolfi rolling	kubeadm-1.34 +6	1.34.11-r7	—
Wolfi rolling	kubeadm-1.35 +10	1.35.8-r6	—
Wolfi rolling	kubeadm-1.36 +6	1.36.4-r7	—
Wolfi rolling	kubernetes-dashboard	7.14.0-r19	—
Wolfi rolling	kubescape	4.0.12-r12	—
Wolfi rolling	kubevela-vela-cli +1	1.11.0-r13	—
Wolfi rolling	kyverno-1.17	1.17.2-r35	—
Wolfi rolling	kyverno-1.18 +5	1.18.2-r14	—
Wolfi rolling	kyverno-cli-1.17 +4	1.17.2-r34	—
Wolfi rolling	litestream	0.5.17-r2	—
Wolfi rolling	loki-3.6 +3	3.6.16-r5	—
Wolfi rolling	loki-3.7 +2	3.7.7-r3	—
Wolfi rolling	melange	0.59.3-r3	—
Wolfi rolling	minio	0.20260717.120751-r13	—
Wolfi rolling	nerdctl	2.3.5-r12	—
Wolfi rolling	nfpm	2.47.0-r9	—
Wolfi rolling	nuclei	3.11.1-r7	—
Wolfi rolling	opentelemetry-collector	0.159.0-r5	—
Wolfi rolling	opentelemetry-collector-contrib	0.160.0-r1	—
Wolfi rolling	opentofu-1.11	1.11.14-r4	—
Wolfi rolling	opentofu-1.12	1.12.6-r4	—
Wolfi rolling	opentofu-1.12-compat	1.12.6-r6	—
Wolfi rolling	opentofu-1.9	1.9.4-r29	—
Wolfi rolling	osv-scanner	2.5.1-r5	—
Wolfi rolling	podman-6.0	6.0.2-r11	—
Wolfi rolling	prometheus-operator +1	0.93.1-r6	—
Wolfi rolling	prometheus-operator-iamguarded-compat	0.94.0-r0	—
Wolfi rolling	pulumi	3.261.0-r1	—
Wolfi rolling	pulumi-kubernetes-operator	2.9.1-r1	—
Wolfi rolling	pulumi-language-dotnet	3.113.1-r2	—
Wolfi rolling	pulumi-language-java	1.36.3-r2	—
Wolfi rolling	pulumi-language-yaml	1.38.5-r2	—
Wolfi rolling	rancher-2.13	2.13.9-r5	—
Wolfi rolling	rancher-2.14 +1	2.14.5-r4	—
Wolfi rolling	rancher-agent-2.13	2.13.9-r2	—
Wolfi rolling	rancher-fleet +3	0.16.1-r3	—
Wolfi rolling	rancher-machine	0.15.0.145-r8	—
Wolfi rolling	rclone	1.75.0-r8	—
Wolfi rolling	rootlesskit	3.1.0-r5	—
Wolfi rolling	ruby3.3-fluent-plugin-grafana-loki-3.7	3.7.7-r4	—
Wolfi rolling	scorecard	5.5.0-r20	—
Wolfi rolling	seaweedfs	4.45-r2	—
Wolfi rolling	sftpgo	2.7.5-r11	—
Wolfi rolling	skaffold	2.24.0-r10	—
Wolfi rolling	snyk-cli	1.1307.0-r4	—
Wolfi rolling	spire-agent +2	1.15.3-r5	—
Wolfi rolling	splunk-otel-collector	0.159.0-r4	—
Wolfi rolling	splunk-otel-collector-compat	0.160.0-r0	—
Wolfi rolling	syft	1.51.1-r2	—
Wolfi rolling	tailscale	1.102.3-r3	—
Wolfi rolling	telegraf-1.38	1.38.4-r25	—
Wolfi rolling	terraform	1.5.7-r60	—
Wolfi rolling	tfsec	1.28.14-r49	—
Wolfi rolling	trivy	0.74.0-r5	—
Wolfi rolling	trivy-operator	0.34.0-r3	—
Wolfi rolling	trufflehog	3.97.4-r3	—
Wolfi rolling	wal-g-pg	3.0.9-r4	—
Wolfi rolling	witness	0.12.0-r10	—
Wolfi rolling	wolfictl	0.39.25-r6	—
Wolfi rolling	xeol	0.10.8-r59	—
Wolfi rolling	zarf	0.85.0-r1	—
Wolfi rolling	zot	2.1.20-r7	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	golang.org/x/crypto	< 0.56.0	0.56.0	GO-2026-6355

Advisories 50

RHSA-2026:90424 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
ALAS2023-2026-3266 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
ALAS2023-2026-3254 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
ALAS2023-2026-3256 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
SUSE-SU-2026:5167-1 Security update for kubevirt SUSE / openSUSE Security Updates · Nov 11, 2026
RLSA-2026:90424 Important: buildah security update Rocky Linux Security Advisories · Oct 29, 2026
ALSA-2026:70640 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:90424 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
SUSE-SU-2026:24282-1 Security update for helm SUSE / openSUSE Security Updates · Oct 27, 2026
ELSA-2026-90424 Important: buildah security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
ALAS2023-2026-3274 Important: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2-2026-4018 Important: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3273 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
openSUSE-SU-2026:12258-1 zk-0.15.7-1.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
SUSE-SU-2026:24213-1 Security update for cosign SUSE / openSUSE Security Updates · Oct 21, 2026
RHSA-2026:70640 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
openSUSE-SU-2026:22064-1 Security update for cosign SUSE / openSUSE Security Updates · Oct 19, 2026
SUSE-SU-2026:24148-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 16, 2026
SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls SUSE / openSUSE Security Updates · Oct 13, 2026
ALAS2-2026-3969 Moderate: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 12, 2026
ALAS2023-2026-3160 Moderate: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
openSUSE-SU-2026:22032-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 9, 2026
SUSE-SU-2026:23984-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
SUSE-SU-2026:23973-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
openSUSE-SU-2026:21999-1 Security update for rclone SUSE / openSUSE Security Updates · Oct 1, 2026
openSUSE-SU-2026:21983-1 Security update for helm SUSE / openSUSE Security Updates · Oct 1, 2026
SUSE-SU-2026:4408-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 1, 2026
openSUSE-SU-2026:11920-1 grafana-12.4.11-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026
SUSE-SU-2026:23924-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Sep 30, 2026
SUSE-SU-2026:4392-1 Security update for cosign SUSE / openSUSE Security Updates · Sep 30, 2026
SUSE-SU-2026:23692-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
SUSE-SU-2026:23712-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
SUSE-SU-2026:4372-1 Security update for amazon-ssm-agent SUSE / openSUSE Security Updates · Sep 29, 2026
ALAS2023-2026-3129 Important: rclone security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
ALAS2023-2026-3140 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
SUSE-SU-2026:23874-1 Security update for google-guest-agent SUSE / openSUSE Security Updates · Sep 28, 2026
SUSE-SU-2026:23876-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Sep 28, 2026
SUSE-SU-2026:23841-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Sep 27, 2026
SUSE-SU-2026:23831-1 Security update for google-guest-agent SUSE / openSUSE Security Updates · Sep 27, 2026
SUSE-SU-2026:23745-1 Security update for google-guest-agent SUSE / openSUSE Security Updates · Sep 27, 2026
SUSE-SU-2026:23736-1 Security update for google-guest-agent SUSE / openSUSE Security Updates · Sep 27, 2026
SUSE-SU-2026:23739-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Sep 27, 2026
openSUSE-SU-2026:21924-1 Security update for cloudflared SUSE / openSUSE Security Updates · Sep 25, 2026
openSUSE-SU-2026:21927-1 Security update for apptainer SUSE / openSUSE Security Updates · Sep 25, 2026
openSUSE-SU-2026:21879-1 Security update for google-guest-agent SUSE / openSUSE Security Updates · Sep 25, 2026
openSUSE-SU-2026:21882-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Sep 25, 2026
openSUSE-SU-2026:21884-1 Security update for amazon-ssm-agent SUSE / openSUSE Security Updates · Sep 25, 2026
openSUSE-SU-2026:11871-1 cosign-3.1.3-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
RLSA-2026:70640 Important: buildah security update Rocky Linux Security Advisories · Sep 24, 2026
SUSE-SU-2026:4308-1 Security update for apptainer SUSE / openSUSE Security Updates · Sep 24, 2026

EUVD	v3.1	7.5
CISA-ADP	v3.1	7.5

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 50

References