RHSA-2026:37271

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.