News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-56855 CVE Medium False Positive

ssh: Connection Deadlock via Unhandled Messages on an Established Channel

This advisory does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh package is a transitive dependency, and neither its channel multiplexer nor any other SSH code path runs during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.11 and EE 2.13.9.

Component

golang.org/x/crypto (SSH)

Disclosed

Sep 7, 2026

Description

Once an SSH channel is established, a malicious peer can send channel messages that Go’s golang.org/x/crypto/ssh multiplexer buffers instead of rejecting. The buffer fills, the mux blocks, and the whole SSH connection deadlocks, a denial of service against the peer. The fix handles every channel message defined in RFC 4254 and treats an unrecognised message as a protocol error that terminates the connection rather than something to queue.

References

View CVE-2026-56855 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates