jsch

Fork of JSch-0.1.55 See original README Why should you use this library? As I explained in a blog post the main points are: OpenSSH has disabled ssh-rsa in release 8.8 per default and you need a library which supports rsa-sha2-256 and rsa-sha2-512. Drop in replacement: just change dependency...

CLEANSTART-2026-YJ32154 security flaw has been discovered in mwiede jsch up to 2

Security vulnerability affects the rundeck package. A security flaw has been discovered in mwiede jsch up to 2...

CLEANSTART-2026-JS37598 security flaw has been discovered in mwiede jsch up to 2

Security vulnerability affects the wso2mi package. A security flaw has been discovered in mwiede jsch up to 2...

Improper Certificate Revocation Checking

mwiede jsch is vulnerable to improper certificate revocation checking. The vulnerability is due to improper validation of revoked keys in the getRevokedKeys function of KnownHosts.java, which allows a remote attacker to bypass certificate revocation checks by manipulating the knownhosts argument...

OPENSUSE-SU-2026:11814-1 jsch-2.28.7-1.1 on GA media

These are all security issues fixed in the jsch-2.28.7-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-86231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file...

SUSE CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

com.criteo.rundeck.plugin:rundeck-tag-orchestrator-plugin (1.3.3), com.github.goldin:about-maven-plugin (>=0.2.4, <=0.2.5) +28 more potentially affected by CVE-2026-78254 via org.apache.ant:ant-jsch (>=1.7.1, <=1.10.14)

org.apache.ant:ant-jsch MAVEN version =1.7.1, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.5 and more Source cves: CVE-2026-78254 Source advisory: MEND:CVE-2026-78254...

EUVD-2026-72179

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the knownhosts parser, where HostKey.name2type lacks OpenSSH certificate-type entries such as [email protected] in its static table, so a @revoked line authored with a...

CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

DEBIAN-CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

UBUNTU-CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

CVE-2026-86231 mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

ch.schlagundrahm.swat.datapower:swat-dp-tools (>=0.3.0, <=0.3.1), com.bavykin.qualistrata:qualistrata-unix (>=0.1.0-alpha.1, <=0.1.0-alpha.2) +150 more potentially affected by CVE-2026-86231 via com.github.mwiede:jsch (>=2.28.0, <=2.28.5)

com.github.mwiede:jsch MAVEN version =2.28.0, =0.3.0, =0.1.0-alpha.1, =2.1.12, =7.3.0, =0.6.19, =0.11.0, =0.11.0, =0.11.0, =0.2.3, =0.2.3, =0.2.3, =0.2.3, =10.2.3, =11.2.6, =11.4.2 and more Source cves: CVE-2026-86231 Source advisory: MEND:CVE-2026-86231...

CVE-2026-86231

mwiede jsch (a Java SSH library) versions up to 2.28.5 contain an improper certificate revocation check in the getRevokedKeys function of src/main/java/com/jcraft/jsch/KnownHosts.java. Manipulating the known_hosts argument allows a remote attacker to bypass revocation verification, resulting in l...

CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

CVE-2026-86231 mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

CVE-2026-86231 mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...