Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
OpenTofu 1.12.7 fixes an SSH provisioner deadlock affecting remote-exec/file against attacker-controlled servers (CVE-2026-78662, CVE-2026-56855). https://github.com/opentofu/opentofu/releases/tag
Post summary
OpenTofu 1.12.7 releases a fix for an SSH provisioner deadlock vulnerability (CVE-2026-78662, CVE-2026-56855) impacting remote-exec/file operations. The announcement functions as a patch notice for the identified issue.
new ssh DoS fixes in http://golang.org/x/crypto v0.56.0: CVE-2026-56855 and CVE-2026-78662. a peer can send crafted channel messages and deadlock your entire connection. if you run go ssh servers: 1. go get http://golang.org/x/crypto@v0.56.0 2. go mod tidy - x/crypto sneaks in as an indirect dep half the time 3. govulncheck to see if the ssh code is even reachable in your binary both reported by the same person. one crafted message away from a deadlocked server, and the fix is a one-liner.
Post summary
Two SSH DoS vulnerabilities (CVE-2026-56855 and CVE-2026-78662) in Go's crypto library can be mitigated by upgrading to v0.56.0, a simple one‑liner fix.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | golang | crypto | - | go | - |