~/security / openssh
OpenSSH: latest vulnerabilities
The newest CVEs for OpenSSH, daily from the NVD. Descriptions come from the database.
| CVE | Published | Severity | Description |
|---|---|---|---|
| CVE-2026-94140 | 21 October 2026 | — | Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key au… |
| CVE-2026-105429 | 14 October 2026 | high 8.9 | Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client ho… |
| CVE-2026-97816 | 13 October 2026 | critical 9.8 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97811 | 13 October 2026 | high 7.8 | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88157 | 13 October 2026 | high 8.8 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83923 | 13 October 2026 | high 8.8 | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83871 | 13 October 2026 | high 7.0 | Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83769 | 13 October 2026 | high 7.8 | Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83754 | 13 October 2026 | high 7.5 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70163 | 13 October 2026 | high 7.5 | Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. |
| CVE-2026-109786 | 13 October 2026 | medium 5.3 | In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as… |
| CVE-2026-106583 | 7 October 2026 | low 2.5 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
| CVE-2026-106589 | 6 October 2026 | low 2.9 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-d… |
| CVE-2026-106588 | 6 October 2026 | low 3.1 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. |
| CVE-2026-106587 | 6 October 2026 | low 3.6 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. |
| CVE-2026-106586 | 6 October 2026 | low 2.5 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283. |
| CVE-2026-106585 | 6 October 2026 | medium 6.5 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. |
| CVE-2026-106584 | 6 October 2026 | low 2.5 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations. |
| CVE-2026-106582 | 6 October 2026 | low 3.7 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. |
| CVE-2026-106555 | 6 October 2026 | low 2.2 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. |
| CVE-2026-106553 | 6 October 2026 | low 2.2 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. |
| CVE-2026-106552 | 6 October 2026 | medium 4.2 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. |
| CVE-2026-17508 | 2 October 2026 | medium 5.3 | In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before … |
| CVE-2026-94029 | 30 September 2026 | medium 6.5 | Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very sm… |
| CVE-2026-93994 | 30 September 2026 | high 8.1 | Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config Authen… |
| CVE-2026-69397 | 8 September 2026 | high 7.5 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-73283 | 11 August 2026 | low 2.5 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
| CVE-2026-73282 | 11 August 2026 | medium 4.8 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
| CVE-2026-73281 | 11 August 2026 | low 3.5 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension… |
| CVE-2026-56624 | 20 July 2026 | high 7.3 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check fo… |
New articles by e-mail
One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).