Please update golang.org/x/crypto/ssh to 0.57.0 to fix CVE-2026-56854, CVE-2026-78662 and CVE-2026-56855
Open
Beginner friendly
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
amazon-ssm-agent currently ships `golang.org/x/crypto` version 0.53.0 which is affected by three CVEs:
- CVE-2026-56854
- CVE-2026-78662
- CVE-2026-56855
Please update the dependency to at least 0.55.0 to fix all three of them.
Contributor guide
Research direction
No file or test is named in the issue; start by locating the Go module declaration for golang.org/x/crypto and checking how version 0.53.0 is recorded. Update it to at least 0.55.0, then run the repository's existing Go tests and verify the dependency no longer uses the affected version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100