From f55031759060af9ff0074c66bae5ef1331c60172 Mon Sep 17 00:00:00 2001 From: Nick Craig-Wood Date: Thu, 3 Sep 2026 10:41:19 +0100 Subject: [PATCH] build: update golang.org/x/crypto to v0.56.0 to fix CVE-2026-78662 and CVE-2026-56855 CVE-2026-78662: a malicious peer could flood an undecided channel's incoming requests, deadlocking the whole connection in golang.org/x/crypto/ssh (GO-2026-6354) CVE-2026-56855: a malicious peer could send crafted messages on an established channel, deadlocking the whole connection in golang.org/x/crypto/ssh (GO-2026-6355) --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2a372ff40..c1457f615 100644 --- a/go.mod +++ b/go.mod @@ -95,7 +95,7 @@ require ( github.com/zeebo/xxh3 v1.1.0 go.etcd.io/bbolt v1.5.0 goftp.io/server/v2 v2.0.3 - golang.org/x/crypto v0.55.0 + golang.org/x/crypto v0.56.0 golang.org/x/net v0.57.0 golang.org/x/oauth2 v0.36.0 golang.org/x/sync v0.22.0 diff --git a/go.sum b/go.sum index 64d1b71f9..3f025d480 100644 --- a/go.sum +++ b/go.sum @@ -658,8 +658,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0 golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= +golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= +golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 h1:qLvzZeaANDgyVOA8pyHCOStGlXn0rseXma+GQjeuv2g= golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q= golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=