News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-56855 CVE Medium False Positive

ssh: Connection Deadlock via Unhandled Messages on an Established Channel

This advisory does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh package is a transitive dependency, and neither its channel multiplexer nor any other SSH code path runs during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.11 and EE 2.13.9.

Component

golang.org/x/crypto (SSH)

Disclosed

Sep 7, 2026

Description

Once an SSH channel is established, a malicious peer can send channel messages that Go’s golang.org/x/crypto/ssh multiplexer buffers instead of rejecting. The buffer fills, the mux blocks, and the whole SSH connection deadlocks, a denial of service against the peer. The fix handles every channel message defined in RFC 4254 and treats an unrecognised message as a protocol error that terminates the connection rather than something to queue.

References

View CVE-2026-56855 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates