Vulnerability-Lookup

RHSA-2026:47756

Vulnerability from csaf_opensuse - Published: 2026-07-29 00:00 - Updated: 2026-07-29 00:00

Summary

security update for openssh

Severity

Important

Notes

Title of the patch: security update for openssh

Description of the patch: This security update provides a functional equivalent of RHSA-2026:47756. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:47756.

Patchnames: RHSA-2026:47756

CVE-2026-55653

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-55654

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2026-55655

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59996

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-60002

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64	—	Vendor Fix

Threats

Impact important

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2026-55653/	self
https://www.suse.com/security/cve/CVE-2026-55654/	self
https://www.suse.com/security/cve/CVE-2026-55655/	self
https://www.suse.com/security/cve/CVE-2026-59996/	self
https://www.suse.com/security/cve/CVE-2026-60002/	self
https://www.suse.com/security/cve/CVE-2026-55653	external
https://www.suse.com/security/cve/CVE-2026-55654	external
https://www.suse.com/security/cve/CVE-2026-55655	external
https://www.suse.com/security/cve/CVE-2026-59996	external
https://bugzilla.suse.com/1271046	external
https://www.suse.com/security/cve/CVE-2026-60002	external
https://bugzilla.suse.com/1271055	external
https://bugzilla.suse.com/1271636	external
https://bugzilla.suse.com/1271706	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for openssh",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:47756.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:47756.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:47756",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_47756.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-55653 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-55653/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-55654 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-55654/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-55655 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-55655/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59996 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-60002 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-60002/"
      }
    ],
    "title": "security update for openssh",
    "tracking": {
      "current_release_date": "2026-07-29T00:00:00Z",
      "generator": {
        "date": "2026-07-29T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:47756",
      "initial_release_date": "2026-07-29T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-29T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-9.9p1-9.el9_8.x86_64",
                "product": {
                  "name": "openssh-9.9p1-9.el9_8.x86_64",
                  "product_id": "openssh-9.9p1-9.el9_8.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-9.9p1-9.el9_8.x86_64",
                "product": {
                  "name": "openssh-askpass-9.9p1-9.el9_8.x86_64",
                  "product_id": "openssh-askpass-9.9p1-9.el9_8.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-9.9p1-9.el9_8.x86_64",
                "product": {
                  "name": "openssh-clients-9.9p1-9.el9_8.x86_64",
                  "product_id": "openssh-clients-9.9p1-9.el9_8.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-9.9p1-9.el9_8.x86_64",
                "product": {
                  "name": "openssh-keycat-9.9p1-9.el9_8.x86_64",
                  "product_id": "openssh-keycat-9.9p1-9.el9_8.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-9.9p1-9.el9_8.x86_64",
                "product": {
                  "name": "openssh-server-9.9p1-9.el9_8.x86_64",
                  "product_id": "openssh-server-9.9p1-9.el9_8.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64",
                "product": {
                  "name": "pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64",
                  "product_id": "pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-9.9p1-9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64"
        },
        "product_reference": "openssh-9.9p1-9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-9.9p1-9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64"
        },
        "product_reference": "openssh-askpass-9.9p1-9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-9.9p1-9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64"
        },
        "product_reference": "openssh-clients-9.9p1-9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-9.9p1-9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64"
        },
        "product_reference": "openssh-keycat-9.9p1-9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-9.9p1-9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64"
        },
        "product_reference": "openssh-server-9.9p1-9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        },
        "product_reference": "pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55653",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-55653"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-55653",
          "url": "https://www.suse.com/security/cve/CVE-2026-55653"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-55653"
    },
    {
      "cve": "CVE-2026-55654",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-55654"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-55654",
          "url": "https://www.suse.com/security/cve/CVE-2026-55654"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-55654"
    },
    {
      "cve": "CVE-2026-55655",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-55655"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-55655",
          "url": "https://www.suse.com/security/cve/CVE-2026-55655"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-55655"
    },
    {
      "cve": "CVE-2026-59996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59996",
          "url": "https://www.suse.com/security/cve/CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271046 for CVE-2026-59996",
          "url": "https://bugzilla.suse.com/1271046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59996"
    },
    {
      "cve": "CVE-2026-60002",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-60002"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
          "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-60002",
          "url": "https://www.suse.com/security/cve/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271055 for CVE-2026-60002",
          "url": "https://bugzilla.suse.com/1271055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271636 for CVE-2026-60002",
          "url": "https://bugzilla.suse.com/1271636"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271706 for CVE-2026-60002",
          "url": "https://bugzilla.suse.com/1271706"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:openssh-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-askpass-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-clients-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-keycat-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:openssh-server-9.9p1-9.el9_8.x86_64",
            "SUSE Liberty Linux 9:pam_ssh_agent_auth-0.10.4-7.9.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-60002"
    }
  ]
}

CVE-2026-55653 (GCVE-0-2026-55653)

Vulnerability from cvelistv5 – Published: 2026-06-23 03:36 – Updated: 2026-07-30 08:22

Title

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Summary

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-415 - Double Free

Assigner

redhat

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:36759	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47755	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-55653	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2462351	issue-trackingx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:9.9p1-25.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.0p1-30.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:9.9p1-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 10.3p1-6.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-06-22 23:17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T14:30:51.025049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T14:31:00.827Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-25.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.0p1-30.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.0p1-30.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "10.3p1-6.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-06-22T23:17:43.088Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T08:22:19.409Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:36759",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:36759"
        },
        {
          "name": "RHSA-2026:47755",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47755"
        },
        {
          "name": "RHSA-2026:47756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47756"
        },
        {
          "name": "RHSA-2026:47757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47757"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-55653"
        },
        {
          "name": "RHBZ#2462351",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462351"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-26T18:54:39.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-22T23:17:43.088Z",
          "value": "Made public."
        }
      ],
      "title": "Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client\u0027s SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure:\n\n```\nKexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\n```\n\n(Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment\u0027s security requirements.)\n\nAdditionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-415: Double Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-55653",
    "datePublished": "2026-06-23T03:36:22.741Z",
    "dateReserved": "2026-06-16T23:55:05.737Z",
    "dateUpdated": "2026-07-30T08:22:19.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55654 (GCVE-0-2026-55654)

Vulnerability from cvelistv5 – Published: 2026-06-23 03:37 – Updated: 2026-07-30 09:47

Title

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Summary

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:36759	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-55654	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2462493	issue-trackingx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:9.9p1-25.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:9.9p1-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 10.3p1-6.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-06-22 23:18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T12:11:38.299870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T12:12:09.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-25.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "10.3p1-6.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unknown",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-06-22T23:18:14.750Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T09:47:18.052Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:36759",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:36759"
        },
        {
          "name": "RHSA-2026:47756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47756"
        },
        {
          "name": "RHSA-2026:47757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47757"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-55654"
        },
        {
          "name": "RHBZ#2462493",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462493"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-26T19:17:42.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-22T23:18:14.750Z",
          "value": "Made public."
        }
      ],
      "title": "Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-55654",
    "datePublished": "2026-06-23T03:37:00.160Z",
    "dateReserved": "2026-06-16T23:55:05.737Z",
    "dateUpdated": "2026-07-30T09:47:18.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55655 (GCVE-0-2026-55655)

Vulnerability from cvelistv5 – Published: 2026-06-23 03:36 – Updated: 2026-07-30 08:22

Title

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Summary

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Assigner

redhat

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:36759	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47755	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-55655	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2462250	issue-trackingx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:9.9p1-25.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.0p1-30.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:9.9p1-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 10.3p1-6.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-06-22 23:22

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T12:21:42.502865Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T12:21:47.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-25.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.0p1-30.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.0p1-30.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.9p1-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "10.3p1-6.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "openssh",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unknown",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-06-22T23:22:11.127Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-923",
              "description": "Improper Restriction of Communication Channel to Intended Endpoints",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T08:22:20.146Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:36759",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:36759"
        },
        {
          "name": "RHSA-2026:47755",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47755"
        },
        {
          "name": "RHSA-2026:47756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47756"
        },
        {
          "name": "RHSA-2026:47757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:47757"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-55655"
        },
        {
          "name": "RHBZ#2462250",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462250"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-26T18:39:13.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-22T23:22:11.127Z",
          "value": "Made public."
        }
      ],
      "title": "Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-55655",
    "datePublished": "2026-06-23T03:36:25.724Z",
    "dateReserved": "2026-06-16T23:55:05.737Z",
    "dateUpdated": "2026-07-30T08:22:20.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59996 (GCVE-0-2026-59996)

Vulnerability from cvelistv5 – Published: 2026-07-08 00:07 – Updated: 2026-07-08 13:03

Summary

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-23 - Relative Path Traversal

Assigner

mitre

References

3 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://marc.info/?l=openssh-unix-dev&m=178333966…
https://www.openssh.org/releasenotes.html#10.4p1

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , < 10.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59996",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:03:36.338882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T13:03:41.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T00:07:07.759Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        },
        {
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-59996",
    "datePublished": "2026-07-08T00:07:07.759Z",
    "dateReserved": "2026-07-08T00:07:07.370Z",
    "dateUpdated": "2026-07-08T13:03:41.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60002 (GCVE-0-2026-60002)

Vulnerability from cvelistv5 – Published: 2026-07-08 00:17 – Updated: 2026-07-08 13:02

Summary

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

mitre

References

3 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://marc.info/?l=openssh-unix-dev&m=178333966…
https://www.openssh.org/releasenotes.html#10.4p1

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , < 10.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:01:59.614190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T13:02:27.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T00:17:33.058Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        },
        {
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-60002",
    "datePublished": "2026-07-08T00:17:33.058Z",
    "dateReserved": "2026-07-08T00:17:32.675Z",
    "dateUpdated": "2026-07-08T13:02:27.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:47756

CVE-2026-55653 (GCVE-0-2026-55653)

CVE-2026-55654 (GCVE-0-2026-55654)

CVE-2026-55655 (GCVE-0-2026-55655)

CVE-2026-59996 (GCVE-0-2026-59996)

CVE-2026-60002 (GCVE-0-2026-60002)

Tags

Sightings

Nomenclature