Skip to content
OpenAdvisories
Medium ALAS2-2026-3320 2 CVEs

Moderate: openssh security update (Amazon Linux 2)

Published May 25, 2026 · Updated May 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35414: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. CVE-2026-35388: OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 openssh 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-askpass 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-cavs 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-clients 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-debuginfo 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-keycat 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-ldap 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-server 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 openssh-server-sysvinit 0:7.4p1-22.amzn2.0.13
Amazon Linux · 2 pam_ssh_agent_auth 0:0.10.3-2.22.amzn2.0.13

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-35388.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-35414.html