Red Hat Security Advisory: openssh security update

Fixed packages 48

Vulnerabilities 8

• Medium 6.5
  CVE-2026-106585

  In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during deco…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux
  Oct 6, 2026
• Medium 5.9
  CVE-2026-59999

  In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 5.0
  CVE-2026-55655

  Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

  A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu Azure Linux
  Jun 23, 2026
• Medium 4.3
  CVE-2026-55653

  Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

  A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu Azure Linux
  Jun 23, 2026
• Medium 4.2
  CVE-2026-59995

  sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Low 3.7
  CVE-2026-106582

  In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux
  Oct 6, 2026
• Low 2.5
  CVE-2026-106583

  In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux
  Oct 6, 2026
• Low 2.2
  CVE-2026-106553

  In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authenticat…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux
  Oct 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2462250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2462351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497927
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497942
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547243
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99592.json
• report
  https://access.redhat.com/security/cve/CVE-2026-55653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55653
• report
  https://access.redhat.com/security/cve/CVE-2026-55655
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55655
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55655
• report
  https://access.redhat.com/security/cve/CVE-2026-59995
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59995
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59995
• article
  https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• article
  https://www.openssh.org/releasenotes.html#10.4p1
• article
  https://www.openwall.com/lists/oss-security/2026/07/06/5
• report
  https://access.redhat.com/security/cve/CVE-2026-59999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59999
• report
  https://access.redhat.com/security/cve/CVE-2026-106553
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-106553
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-106553
• article
  https://www.openssh.org/releasenotes.html#10.6
• report
  https://access.redhat.com/security/cve/CVE-2026-106582
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-106582
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-106582
• article
  https://arxiv.org/abs/2609.07709
• report
  https://access.redhat.com/security/cve/CVE-2026-106583
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-106583
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-106583
• report
  https://access.redhat.com/security/cve/CVE-2026-106585
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-106585
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-106585