TI-2026-42784 CVE-2026-60002 · GHSA-gp5v-jg37-fvg6
Use after free in OpenBSD OpenSSH
Priority MEDIUM 42
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.
RHSA-2026:89739
openssh security update
Released 2026-10-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.2) openssh-askpass-8.7p1-30.el9_2.13, pam_ssh_agent_auth-0.10.4-5.30.el9_2.13
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssh-8.7p1-30.el9_2.13, openssh-clients-8.7p1-30.el9_2.13, openssh-keycat-8.7p1-30.el9_2.13 +1
Fixes 6 records
TI-2026-42781 CVE-2026-59999 · GHSA-gcm2-x6hm-q4h3
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…
Priority LOW 32
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
TI-2026-40178 CVE-2026-55653 · GHSA-28f3-55mq-pp68
Double free in Red Hat Enterprise Linux 10
Priority LOW 29
A flaw was found in OpenSSH.
TI-2026-40180 CVE-2026-55655 · GHSA-wcvf-3x75-j4c6
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat…
Priority LOW 26
A flaw was found in OpenSSH.
TI-2026-42778 CVE-2026-59996 · GHSA-8v2x-fhq9-4fv3
Path traversal in OpenBSD OpenSSH
Priority LOW 24
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
TI-2026-42777 CVE-2026-59995 · GHSA-2prh-86cw-fm96
Path traversal in OpenBSD OpenSSH
Priority LOW 24
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.