CVE-2026-106589

The OpenSSH sshd daemon (versions through 10.6) is vulnerable to a Least Privilege Violation (CWE-272) in specific environments, notably QNX 6 and SCO OpenServer 5 . The flaw allows sshd-session to unexpectedly gain root privileges . This issue stems from the GatewayPorts and StreamLocalForwardin...

AZL-106691 CVE-2026-106585 affecting package openssh 9.8p1-10

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

AZL-106706 CVE-2026-106553 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

AZL-106709 CVE-2026-106555 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

DEBIAN-CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

DEBIAN-CVE-2026-106555

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

AZL-106688 CVE-2026-106586 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

DEBIAN-CVE-2026-106586

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

AZL-106694 CVE-2026-106582 affecting package openssh 9.8p1-10

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings...

DEBIAN-CVE-2026-106582

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings...

DEBIAN-CVE-2026-106585

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

CVE-2026-106555

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

CVE-2026-106582

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings...

CVE-2026-106585

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

CVE-2026-106586

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

CVE-2026-106588

The sshd component in OpenSSH versions through 10.6 is affected by a vulnerability where the use of the macOS 27 (or later) SDK results in a loss of sandboxing . This side effect is noted as potentially unexpected and relates to improper isolation (CWE-653). No specific exploit details or remedia...

CVE-2026-106588

In sshd in OpenSSH through 10.6, use of the macOS 27 or later SDK has the side effect of loss of sandboxing, which is potentially unexpected...

CVE-2026-106588

In sshd in OpenSSH through 10.6, use of the macOS 27 or later SDK has the side effect of loss of sandboxing, which is potentially unexpected...

CVE-2026-106588

In sshd in OpenSSH through 10.6, use of the macOS 27 or later SDK has the side effect of loss of sandboxing, which is potentially unexpected...