OpenSSH vulnerabilities

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

The auth_password function in sshd in OpenSSH before version 7.3 does not limit password lengths for authentication, allowing remote attackers to cause a denial of service via long strings.

The do_setup_env function in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program.

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection. This allows remote attackers to conduct brute-force attacks or cause denial of service via a long and duplicative list in the ssh -oKbdInteractiveDevices option.

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures. This may allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

In sshd in OpenSSH before version 10.0, the DisableForwarding directive does not adhere to documentation, failing to disable X11 and agent forwarding.

When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.

Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.

A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key.

The vulnerability in ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol. This allows remote attackers to bypass the need for knowledge of the shared secret and successfully authenticate by sending crafted values in each round of the protocol.

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to apply to tunnel forwarding but was not enforced. This is a different vulnerability than CVE-2026-73283.

In sshd and ssh in OpenSSH before version 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times due to Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

In sftp in OpenSSH before version 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

In sshd in OpenSSH before 10.5, the 'restrict' keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

In OpenSSH before version 10.4, a use-after-free vulnerability exists in the SSH client during key re-exchange when a server changes its host key. This issue affects only the client side.

A vulnerability in OpenSSH before version 10.4 causes the sshd server to not always enforce the minimum authentication delay. This could allow an attacker to perform login attempts more quickly.

A vulnerability in OpenSSH before version 10.4 allows remote attackers to cause a denial of service (DoS) via excessive GSSAPI authentication attempts. The issue stems from improper handling of the MaxAuthTries limit for GSSAPIAuthentication.

In OpenSSH before version 10.4, the DisableForwarding=yes option did not override PermitTunnel=yes, allowing SSH tunneling despite forwarding being disabled.

In OpenSSH before version 10.4, an undocumented security-relevant behavior was found: the GSSAPIStrictAcceptorCheck parameter has no value when the server is in a Windows Active Directory environment.

A vulnerability in the internal-sftp server in sshd in OpenSSH before version 10.4 causes only the first 9 command-line arguments to be recognized. This can be significant if a later argument would have ensured the intended security properties of an SFTP connection.

A vulnerability in the scp tool in OpenSSH before version 10.4 may place a file in the parent directory of the intended directory when copying between two remote destinations.

A vulnerability in the SFTP client in OpenSSH before version 10.4 allows an attacker-controlled server to write downloaded files outside the intended target directory when using the "sftp server:/path ." command.

A flaw in OpenSSH allows a local unprivileged attacker to hijack forwarded X11 connections. The attack pre-binds the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input.

A heap out-of-bounds read flaw was found in OpenSSH during cleanup of GSSAPI indicators when a trailing NULL is missing in the auth-indicators array. A remote attacker, under specific configurations with GSSAPI authentication and a Kerberos environment, could exploit this to crash the SSH authentication path, causing a denial of service (DoS).

A double free vulnerability was found in OpenSSH in the Diffie-Hellman Group Exchange (DH-GEX) client path during FIPS mode known-group validation. A malicious SSH server can exploit this by sending crafted DH-GEX group parameters, causing client process termination and Denial of Service (DoS).

The RSA and DSA public key parsers did not enforce size limits on key parameters, allowing a DoS attack by sending a crafted key with an excessively large modulus or DSA parameter. Signature verification could take several minutes.

An authenticated SSH client that repeatedly opened channels rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

OpenSSH before version 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

OpenSSH before version 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions, potentially allowing unauthorized access.

In OpenSSH before version 10.3, listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to allow all ECDSA algorithms.

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in ssh_config.

In OpenSSH before 10.3, a file downloaded by scp may be installed with setuid or setgid bits if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Vulnerability in OpenSSH GSSAPI patches added by various Linux distributions. The use of sshpkt_disconnect() instead of ssh_packet_disconnect() does not terminate the process, allowing an attacker to send an unexpected GSSAPI message type during key exchange, leading to access of uninitialized variables and potential undefined behavior.

A vulnerability in OpenSSH before version 10.1 allows the null character ('\0') in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

A vulnerability in OpenSSH before version 10.1 allows control characters in usernames from potentially untrusted sources, such as the command line or %-sequence expansion in configuration files. This can lead to code execution when a ProxyCommand is used.

In ssh-agent in OpenSSH before 9.6, destination constraints can be incompletely applied when adding PKCS#11-hosted private keys. Constraints are only applied to the first key, even if the PKCS#11 token returns multiple keys.

A vulnerability in sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process if the configuration specifies running the command as a different user.