Vulnerabilidades do Openbsd Openssh

CVE-2026-106583 Alta · 7.8 CWE-99 06/10/2026

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username…

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

CVE-2026-106589 Baixa · 2.9 CWE-272 06/10/2026

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO…

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

CVE-2026-106588 Baixa · 3.1 CWE-653 06/10/2026

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect…

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

CVE-2026-106587 Baixa · 3.3 CWE-843 06/10/2026

Type Confusion em Openbsd Openssh

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

CVE-2026-106582 Baixa · 3.7 CWE-514 06/10/2026

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though…

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVE-2026-106555 Alta · 7.5 CWE-669 06/10/2026

Incorrect Resource Transfer Between Spheres em Openbsd Openssh

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

CVE-2026-106553 Alta · 7.5 CWE-669 06/10/2026

Incorrect Resource Transfer Between Spheres em Openbsd Openssh

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

CVE-2026-106586 Média · 4.3 CWE-670 06/10/2026

Always-Incorrect Control Flow Implementation em Openbsd Openssh

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

CVE-2026-106585 Média · 6.5 CWE-409 06/10/2026

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet…

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

CVE-2026-106584 Baixa · 3.3 CWE-193 06/10/2026

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times…

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

CVE-2026-106552 Média · 6.5 CWE-23 06/10/2026

Relative Path Traversal em Openbsd Openssh

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

CVE-2026-55654 Baixa · 3.7 CWE-125 23/06/2026

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

CVE-2026-55655 Média · 6.1 CWE-923 23/06/2026

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

CVE-2026-55653 Média · 6.5 CWE-415 23/06/2026

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

CVE-2026-35414 Alta · 8.1 CWE-670 02/04/2026

Always-Incorrect Control Flow Implementation em Openbsd Openssh

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

CVE-2026-35388 Baixa · 2.5 CWE-420 02/04/2026

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode…

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CVE-2026-35387 Média · 6.5 CWE-670 02/04/2026

Always-Incorrect Control Flow Implementation em Openbsd Openssh

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

CVE-2026-35386 Alta · 8.1 CWE-696 02/04/2026

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

CVE-2026-35385 Alta · 8.1 CWE-281 02/04/2026

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an…

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

CVE-2026-3497 Alta · 7.5 CWE-908 12/03/2026

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This...

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

CVE-2025-61985 Baixa · 3.6 CWE-158 06/10/2025

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially…

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

CVE-2025-61984 Baixa · 3.6 CWE-159 06/10/2025

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from…

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

CVE-2025-32728 Baixa · 3.8 CWE-440 09/04/2025

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the…

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

CVE-2025-26466 Média · 5.9 CWE-770 28/02/2025

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVE-2024-6387 Alta · 8.1 CWE-362 01/07/2024

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.