CVE Catalog
CVE-2026-35387
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
In OpenSSH before version 10.3, listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to allow all ECDSA algorithms.
Risk Assessment
This can lead to the use of unauthorized ECDSA algorithms, weakening SSH authentication security and potentially enabling man-in-the-middle attacks.
Recommendation
Upgrade OpenSSH to version 10.3 or later and review algorithm configuration.
Original NVD description (English source)
OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.