CLEANSTART-2026-WA03785 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

🗓️ 30 Jan 2026 16:05:24Reported by GoogleType

osv

osv🔗 osv.dev👁 11 Views

SSH servers in argo-workflows-fips fail to validate GSSAPI mechanism count, risking exhaustion.

Reporter	Title	Published	Views	Family All 3339
OSV	OPENSUSE-SU-2025:15852-1 trivy-0.68.2-1.1 on GA media	29 Dec 202500:00	–	osv
OSV	OPENSUSE-SU-2025:20143-1 Security update for git-bug	4 Dec 202513:08	–	osv
OSV	OPENSUSE-SU-2025:20177-1 Security update for cheat	18 Dec 202500:17	–	osv
OSV	OPENSUSE-SU-2026:10013-1 apptainer-1.4.5-1.1 on GA media	7 Jan 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10042-1 mcphost-0.32.0-1.1 on GA media	13 Jan 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10127-1 rekor-1.5.0-1.1 on GA media	30 Jan 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10142-1 traefik-3.6.7-1.1 on GA media	3 Feb 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10143-1 traefik2-2.11.35-1.1 on GA media	3 Feb 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10230-1 vexctl-0.4.1+git78.f951e3a-1.1 on GA media	19 Feb 202600:00	–	osv
OSV	OPENSUSE-SU-2026:10232-1 cosign-3.0.4-2.1 on GA media	20 Feb 202600:00	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WA03785
osv	www.osv.dev/vulnerability/CVE-2025-0913
osv	www.osv.dev/vulnerability/CVE-2025-4673
osv	www.osv.dev/vulnerability/CVE-2025-47907
osv	www.osv.dev/vulnerability/CVE-2025-47914
osv	www.osv.dev/vulnerability/CVE-2025-58181
osv	www.osv.dev/vulnerability/CVE-2025-62156
osv	www.osv.dev/vulnerability/CVE-2025-62157
osv	www.osv.dev/vulnerability/GHSA-C2HV-4PFJ-MM2R
osv	www.osv.dev/vulnerability/GHSA-CFPF-HRX2-8RV6

20 May 2026 18:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.0058

generic security services authentication requests mechanism count memory exhaustion argo workflows fips