TI-2026-42783 CVE-2026-60001 · GHSA-8pmr-cc7f-4v7w
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
Priority LOW 35
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
RHSA-2026:76748
openssh security update
Released 2026-10-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) openssh-askpass-9.9p1-7.el10_0.5, openssh-keysign-9.9p1-7.el10_0.5
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssh-9.9p1-7.el10_0.5, openssh-clients-9.9p1-7.el10_0.5, openssh-keycat-9.9p1-7.el10_0.5 +1
Fixes 7 records
TI-2026-42781 CVE-2026-59999 · GHSA-gcm2-x6hm-q4h3
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…
Priority LOW 32
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
TI-2026-40178 CVE-2026-55653 · GHSA-28f3-55mq-pp68
Double free in Red Hat Enterprise Linux 10
Priority LOW 29
A flaw was found in OpenSSH.
TI-2026-40180 CVE-2026-55655 · GHSA-wcvf-3x75-j4c6
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat…
Priority LOW 26
A flaw was found in OpenSSH.
TI-2026-42778 CVE-2026-59996 · GHSA-8v2x-fhq9-4fv3
Path traversal in OpenBSD OpenSSH
Priority LOW 24
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
TI-2026-42777 CVE-2026-59995 · GHSA-2prh-86cw-fm96
Path traversal in OpenBSD OpenSSH
Priority LOW 24
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
TI-2026-51407 CVE-2026-73282 · GHSA-jwc3-6qvm-4r66
Use after free in OpenBSD OpenSSH
Priority LOW 21
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.