CVE-2026-73283

A flaw was found in OpenSSH's sshd component. The restrict keyword, designed to limit tunnel forwarding within the authorizedkeys file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to...

JLSEC-2026-1322 sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior:...

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

JLSEC-2026-1325 sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

JLSEC-2026-1323 In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...

JLSEC-2026-1321 internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments,...

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

PT-2026-80571

In sshd in OpenSSH before 10.5, the restrict keyword in authorized keys was supposed to be applicable to tunnel forwarding but was not...

PT-2026-80566

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was mishandled for GSSAPIAuthentication...

PT-2026-80564

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

PT-2026-80567

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

PT-2026-80563

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

PT-2026-80565

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

OESA-2026-3351 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.CVE-2026-59995 scp in OpenSSH before 10.4 may place a file in the...

Security update for openssh

This update for openssh fixes the following issues: Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled server bsc1271044...

SUSE-SU-2026:3605-1 Security update for openssh

This update for openssh fixes the following issues: - Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled server bsc1271044. -...

OpenSSH < 10.5 Multiple Vulnerabilities

The version of OpenSSH installed on the remote host is prior to 10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.5 advisory. - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations a...

CVE-2026-56624

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...