A vulnerability in the golang.org/x/crypto/ssh package allows an unauthenticated remote attacker to cause a denial of service by deadlocking SSH connections.

The vulnerability is a resource management flaw (CWE-770) where the SSH mux fails to properly handle incoming channel requests before a channel is fully established. An unauthenticated attacker can flood the incomingRequests parameter to deadlock the entire connection.

The ability for an unauthenticated attacker to remotely deadlock SSH connections presents a significant risk to system availability and administrative access. With a CVSS score of 7.5, this high severity flaw could be leveraged to disrupt critical infrastructure or management interfaces that rely on the Go SSH implementation, potentially leading to widespread service outages.

Immediate Action: Update the golang.org/x/crypto/ssh package to version 0.56.0 or later to ensure the new atomic established state logic is implemented.

Proactive Monitoring: Monitor network traffic and server logs for unusual spikes in SSH connection requests or repeated connection timeouts that may indicate exploitation attempts.

Compensating Controls: While no direct WAF exists for internal SSH traffic, ensure that network-level access control lists (ACLs) restrict SSH access to known, trusted management IP addresses to reduce the attack surface.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability and the potential for complete service disruption via connection deadlocking, organizations must prioritize upgrading their Go dependencies. Please audit all applications utilizing the golang.org/x/crypto/ssh module and apply the patch to version 0.56.0 immediately to eliminate this denial of service vector.