Total
134 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-55654 | 2 Openbsd, Redhat | 3 Openssh, Enterprise Linux, Hardened Images | 2026-07-30 | N/A | 3.7 LOW |
| A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service. | |||||
| CVE-2026-55655 | 2 Openbsd, Redhat | 2 Openssh, Enterprise Linux | 2026-07-30 | N/A | 5.0 MEDIUM |
| A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session. | |||||
| CVE-2026-55653 | 2 Openbsd, Redhat | 4 Openssh, Enterprise Linux, Hardened Images and 1 more | 2026-07-30 | N/A | 4.3 MEDIUM |
| A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS). | |||||
| CVE-2026-35386 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 3.6 LOW |
| In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config. | |||||
| CVE-2026-35387 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 3.1 LOW |
| OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms. | |||||
| CVE-2026-35414 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 4.2 MEDIUM |
| OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. | |||||
| CVE-2026-35385 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 7.5 HIGH |
| In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode). | |||||
| CVE-2026-35388 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 2.5 LOW |
| OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. | |||||
| CVE-2026-3497 | 4 Canonical, Debian, Openbsd and 1 more | 4 Ubuntu Linux, Debian Linux, Openssh and 1 more | 2026-07-15 | N/A | 7.5 HIGH |
| Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration. | |||||
| CVE-2025-26465 | 4 Debian, Netapp, Openbsd and 1 more | 6 Debian Linux, Active Iq Unified Manager, Ontap and 3 more | 2026-07-14 | N/A | 6.8 MEDIUM |
| A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. | |||||
| CVE-2023-51384 | 2 Debian, Openbsd | 2 Debian Linux, Openssh | 2026-07-14 | N/A | 5.5 MEDIUM |
| In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. | |||||
| CVE-2023-28531 | 2 Netapp, Openbsd | 4 Brocade Fabric Operating System, Hci Bootstrap Os, Solidfire Element Os and 1 more | 2026-07-14 | N/A | 9.8 CRITICAL |
| ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. | |||||
| CVE-2021-41617 | 5 Fedoraproject, Netapp, Openbsd and 2 more | 14 Fedora, Active Iq Unified Manager, Aff 500f and 11 more | 2026-07-14 | 4.4 MEDIUM | 7.0 HIGH |
| sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. | |||||
| CVE-2026-59995 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server. | |||||
| CVE-2026-59996 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. | |||||
| CVE-2026-59997 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection. | |||||
| CVE-2026-59998 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.8 MEDIUM |
| sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. | |||||
| CVE-2026-59999 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 5.9 MEDIUM |
| In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. | |||||
| CVE-2026-60000 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 3.7 LOW |
| sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication. | |||||
| CVE-2026-60001 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 6.5 MEDIUM |
| sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. | |||||