Message Handling Vulnerability in Go Programming Language

CVE-2026-56855

What is CVE-2026-56855?

A vulnerability exists within the Go programming language where a malicious peer could exploit crafted messages after establishing a channel, leading to a situation where the entire connection enters a deadlock state. The newly revised handling mechanism for RFC 4254 channel messages ensures that global requests are managed explicitly. Any unrecognized message type is now treated as a protocol error which results in tearing down the connection instead of allowing the situation to escalate by buffering and blocking.

References