CVE-2026-56624

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-56623

The CVE-2026-56623 issue affects deployments using Apache MINA SSHD’s sshd-git to implement a git server on Windows. The vulnerability arises from Windows-specific path validation that is partly ineffective, potentially allowing an authenticated remote user to access git repositories outside the ...

CVE-2026-56624 Apache MINA SSHD: SSH certificate options lack validations

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

CVE-2026-56624

The vulnerability CVE-2026-56624 affects Apache MINA SSHD (server-side) where OpenSSH user certificates with unsupported options, specifically force-command and verify-required, were not validated during authentication. The issue allows a user with such a certificate to potentially run commands b...

CVE-2026-58624

The CVE affects SSH servers implemented with Apache MINA SSHD that use the GitPgmCommandFactory. The root cause is improper input validation in the sshd-git GitPgmCommandFactory, which allowed an authenticated SSH user to run any JGit command, including commands that could write files on the serv...

CVE-2026-56452

CVE-2026-56452 describes a path traversal in the sshd-scp function of Apache MINA SSHD. The root cause is failure to validate filenames in SCP commands “C”/“D”, allowing a malicious sender to craft filenames that can write to attacker-controlled paths. Affected products are Apache MINA SSHD when ...

openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts

A flaw was found in OpenSSH's Secure Shell Daemon sshd. This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using...

CVE-2026-59998

A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity...

UBUNTU-CVE-2026-60001

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

CVE-2026-60001

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

CVE-2026-60000

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was mishandled for GSSAPIAuthentication...

CVE-2026-60000

CVE-2026-60000 affects OpenSSH sshd prior to 10.4. The vulnerability arises from mishandling MaxAuthTries for GSSAPIAuthentication, enabling a remote attacker to cause denial of service via resource exhaustion from excessive authentication attempts. Impact is a server-wide DoS (availability loss)...

CVE-2026-59999

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

SUSE-SU-2026:2472-1 Security update for apache-sshd, jpgpj

This update for apache-sshd, jpgpj fixes the following issues - CVE-2020-36843: no check performed on scalar to avoid signature malleability bsc1239551. - CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git bsc1267018. Changes for jpgpj: - Initial packaging with v1.3...