A high-severity denial of service vulnerability in the golang.org/x/crypto/ssh package allows remote attackers to deadlock and terminate connections via crafted protocol messages.

This vulnerability, categorized under CWE-770, occurs because the SSH implementation fails to properly handle unexpected protocol messages after a channel is established. An unauthenticated remote peer can exploit this to force the connection into a deadlock state, resulting in a denial of service.

The ability for an unauthenticated attacker to cause a denial of service against services utilizing the golang.org/x/crypto/ssh library poses a significant risk to system availability. Given the CVSS score of 7.5, this flaw could lead to widespread service disruption for applications relying on this cryptographic library for secure communications.

Immediate Action: Update the golang.org/x/crypto package to version 0.56.0 or later immediately to incorporate the necessary protocol handling fixes.

Proactive Monitoring: Monitor network traffic for an unusual frequency of dropped SSH connections or protocol error logs that may indicate attempts to trigger this deadlock condition.

Compensating Controls: While standard WAFs may struggle to inspect encrypted SSH traffic, network-level rate limiting and connection timeouts can help mitigate the impact of malicious peers attempting to exhaust resources.

Public Exploit Available: No

Organizations utilizing the golang.org/x/crypto/ssh package must prioritize updating to version 0.56.0 to eliminate this denial of service vector. Failure to patch leaves critical infrastructure vulnerable to remote connection termination, which could be leveraged to disrupt essential services or bypass security controls reliant on stable SSH tunnels.