CVE-2026-56854

Go/golang.org/x/crypto CVE-2026-56854: unknown, EPSS 0.44%

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Action: Upgrade golang.org/x/crypto to 0.55.0 or later.

go get golang.org/x/crypto@v0.55.0

Affected

Fixed versions

Sources

• osv: GO-2026-6303
• https://go.dev/issue/80213
• https://go.dev/cl/797040

CVE-2026-56854 · published 2026-08-28T14:47:45Z · modified 2026-08-29T10:10:52.440319762Z · JSON