Read the docs
Red Hat Security Advisory

RHSA-2026:82247

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 10 records

TI-2026-69092 CVE-2026-106585 · GHSA-j4h6-744f-q3hq

Missing packet length check in OpenSSH sshd and ssh decompression

Priority LOW 34

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0019 Published 2026-10-06 Partial fix · 10.6 CWE-409
TI-2026-69090 CVE-2026-106583 · GHSA-99hr-wq4p-x49q

Injection via command-line usernames in OpenSSH ssh client

Priority LOW 33

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00151 Published 2026-10-06 Partial fix · 10.6 CWE-99
TI-2026-69086 CVE-2026-106552 · GHSA-695p-3q57-gff4

Path traversal in OpenSSH sftp lets servers write files elsewhere

Priority LOW 29

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00358 Published 2026-10-06 Partial fix · 10.6 CWE-23
TI-2026-69093 CVE-2026-106586 · GHSA-jrjw-pc9r-c624

OpenSSH sshd ignores restrict keyword for tunnel forwarding

Priority LOW 19

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00124 Published 2026-10-06 Fixed in 10.6 CWE-670
TI-2026-69089 CVE-2026-106582 · GHSA-9xxf-58mh-q784

Covert channel in OpenSSH sshd and ssh via LZ77 compression

Priority LOW 17

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00183 Published 2026-10-06 Partial fix · 10.6 CWE-514
TI-2026-69094 CVE-2026-106587 · GHSA-8fmq-pfxf-6hmc

OpenSSH sshd reads the configuration value none as a filename

Priority LOW 16

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

CVSS 3.1LOW 3.6 Local Low privileges No interaction EPSS 0.00085 Published 2026-10-06 Fixed in 10.6 CWE-843