Red Hat Security Advisory: openssh security update

Fixed packages 22

Vulnerabilities 6

• High 7.7
  CVE-2026-60002

  ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 5.9
  CVE-2026-59999

  In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 5.0
  CVE-2026-55655

  Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

  A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu Azure Linux
  Jun 23, 2026
• Medium 4.3
  CVE-2026-55653

  Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

  A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu Azure Linux
  Jun 23, 2026
• Medium 4.2
  CVE-2026-59995

  sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 4.2
  CVE-2026-59996

  scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2462250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2462351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497927
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497942
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497944
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89739.json
• report
  https://access.redhat.com/security/cve/CVE-2026-55653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55653
• report
  https://access.redhat.com/security/cve/CVE-2026-55655
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55655
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55655
• report
  https://access.redhat.com/security/cve/CVE-2026-59995
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59995
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59995
• article
  https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• article
  https://www.openssh.org/releasenotes.html#10.4p1
• article
  https://www.openwall.com/lists/oss-security/2026/07/06/5
• report
  https://access.redhat.com/security/cve/CVE-2026-59996
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59996
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59996
• report
  https://access.redhat.com/security/cve/CVE-2026-59999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59999
• report
  https://access.redhat.com/security/cve/CVE-2026-60002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-60002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-60002