~/security / openssh
OpenSSH: aktuelle Sicherheitslücken
Die neuesten CVEs zu OpenSSH, täglich aus der NVD. Die Beschreibungen stammen aus der Datenbank (englisch).
| CVE | Veröffentlicht | Schwere | Beschreibung |
|---|---|---|---|
| CVE-2026-94140 | 21. Oktober 2026 | — | Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key au… |
| CVE-2026-105429 | 14. Oktober 2026 | hoch 8.9 | Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client ho… |
| CVE-2026-97816 | 13. Oktober 2026 | kritisch 9.8 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97811 | 13. Oktober 2026 | hoch 7.8 | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88157 | 13. Oktober 2026 | hoch 8.8 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83923 | 13. Oktober 2026 | hoch 8.8 | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83871 | 13. Oktober 2026 | hoch 7.0 | Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83769 | 13. Oktober 2026 | hoch 7.8 | Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83754 | 13. Oktober 2026 | hoch 7.5 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70163 | 13. Oktober 2026 | hoch 7.5 | Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. |
| CVE-2026-109786 | 13. Oktober 2026 | mittel 5.3 | In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as… |
| CVE-2026-106583 | 7. Oktober 2026 | niedrig 2.5 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
| CVE-2026-106589 | 6. Oktober 2026 | niedrig 2.9 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-d… |
| CVE-2026-106588 | 6. Oktober 2026 | niedrig 3.1 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. |
| CVE-2026-106587 | 6. Oktober 2026 | niedrig 3.6 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. |
| CVE-2026-106586 | 6. Oktober 2026 | niedrig 2.5 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283. |
| CVE-2026-106585 | 6. Oktober 2026 | mittel 6.5 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. |
| CVE-2026-106584 | 6. Oktober 2026 | niedrig 2.5 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations. |
| CVE-2026-106582 | 6. Oktober 2026 | niedrig 3.7 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. |
| CVE-2026-106555 | 6. Oktober 2026 | niedrig 2.2 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. |
| CVE-2026-106553 | 6. Oktober 2026 | niedrig 2.2 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. |
| CVE-2026-106552 | 6. Oktober 2026 | mittel 4.2 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. |
| CVE-2026-17508 | 2. Oktober 2026 | mittel 5.3 | In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before … |
| CVE-2026-94029 | 30. September 2026 | mittel 6.5 | Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very sm… |
| CVE-2026-93994 | 30. September 2026 | hoch 8.1 | Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config Authen… |
| CVE-2026-69397 | 8. September 2026 | hoch 7.5 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-73283 | 11. August 2026 | niedrig 2.5 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
| CVE-2026-73282 | 11. August 2026 | mittel 4.8 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
| CVE-2026-73281 | 11. August 2026 | niedrig 3.5 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension… |
| CVE-2026-56624 | 20. Juli 2026 | hoch 7.3 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check fo… |
Neue Artikel per E-Mail
Eine E-Mail pro neuem Artikel. Kein Tracking, jederzeit abbestellbar. Als Dankeschön nach der Bestätigung: meine Checkliste „Server-Betrieb & Patching“ (PDF).