Read the docs
TI-2025-38314 Aliases CVE-2025-61984GHSA-hh67-847q-q3h9

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from…

Priority MEDIUM 52CWE-159Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 21 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Fix Partial OpenSSH (OpenBSD): 10.1Red Hat: 13 advisoriesRed Hat: 21 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenBSDOpenSSHbefore 10.110.1Patch availableCNA
  • OpenSSH VendorOpenBSD Affected before 10.1 Fixed in 10.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*——OpenBSD
  • cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions — — ·OpenBSD

Remediation

  • Fix · CNA OpenSSH (OpenBSD) Fixed in 10.1

Red Hat 13 advisories

  • RHSA-2026:5475 Released 2026-03-23 · Red Hat rating Important
    Red Hat Hardened Images RPM Release
    • Red Hat Hardened Images openssh-10.2p1-9.hum1@aarch64, openssh-10.2p1-9.hum1@src, openssh-10.2p1-9.hum1@x86_64 +12
  • RHSA-2026:1858 Released 2026-02-03 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:1815 Released 2026-02-03 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) openssh-askpass-8.7p1-30.el9_2.9, pam_ssh_agent_auth-0.10.4-5.30.el9_2.9
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssh-8.7p1-30.el9_2.9, openssh-clients-8.7p1-30.el9_2.9, openssh-keycat-8.7p1-30.el9_2.9 +1
Show 10 more Red Hat advisories
  • RHSA-2026:1790 Released 2026-02-03 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) openssh-askpass-8.7p1-13.el9_0.1, pam_ssh_agent_auth-0.10.4-4.13.el9_0.4
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) openssh-8.7p1-13.el9_0.1, openssh-clients-8.7p1-13.el9_0.1, openssh-keycat-8.7p1-13.el9_0.1 +1
  • RHSA-2026:1678 Released 2026-02-02 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) openssh-askpass-9.9p1-7.el10_0.1, openssh-keysign-9.9p1-7.el10_0.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssh-9.9p1-7.el10_0.1, openssh-clients-9.9p1-7.el10_0.1, openssh-keycat-9.9p1-7.el10_0.1 +1
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:0976 Released 2026-01-22 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) openssh-askpass-8.7p1-38.el9_4.6, pam_ssh_agent_auth-0.10.4-5.38.el9_4.6
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) openssh-8.7p1-38.el9_4.6, openssh-clients-8.7p1-38.el9_4.6, openssh-keycat-8.7p1-38.el9_4.6 +1
  • RHSA-2026:0693 Released 2026-01-15 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) openssh-askpass-8.7p1-45.el9_6.1, pam_ssh_agent_auth-0.10.4-5.45.el9_6
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) openssh-8.7p1-45.el9_6.1, openssh-clients-8.7p1-45.el9_6.1, openssh-keycat-8.7p1-45.el9_6.1 +1
  • RHSA-2026:0685 Released 2026-01-15 · Red Hat rating Moderate
    Red Hat Update Infrastructure 5 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:23481 Released 2025-12-17 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-27.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-27.el8_10, openssh-cavs-8.0p1-27.el8_10, openssh-clients-8.0p1-27.el8_10 +4
  • RHSA-2025:23480 Released 2025-12-17 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass-8.7p1-47.el9_7, pam_ssh_agent_auth-0.10.4-5.47.el9_7
    • Red Hat Enterprise Linux BaseOS (v. 9) openssh-8.7p1-47.el9_7, openssh-clients-8.7p1-47.el9_7, openssh-keycat-8.7p1-47.el9_7 +1
  • RHSA-2025:23479 Released 2025-12-17 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream (v. 10) openssh-askpass-9.9p1-12.el10_1, openssh-keysign-9.9p1-12.el10_1
    • Red Hat Enterprise Linux BaseOS (v. 10) openssh-9.9p1-12.el10_1, openssh-clients-9.9p1-12.el10_1, openssh-keycat-9.9p1-12.el10_1 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenBSD OpenSSH 10.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-38315 ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially…Priority LOW 16
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7Fixed RHSA-2026:1858
Red Hat Ceph Storage 8Fixed RHSA-2026:1652
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:23479
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:23481
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:23480
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:1790
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:1815
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:1678
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0976
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:0693
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:23479
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:23481
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:23480
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:1790
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:1815
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:1678
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:0976
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:0693
Red Hat Hardened ImagesFixed RHSA-2026:5475
Red Hat Update Infrastructure 5Fixed RHSA-2026:0685
Not affected: 4 products
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Discovery 2
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61984
  2. 2026-10-03 Alias added: GHSA-hh67-847q-q3h9

References

Other 3

  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19792 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
See all 369 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences