openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel,...

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...

OpenSSH < 10.6 Multiple Vulnerabilities

The version of OpenSSH installed on the remote host is prior to 10.6. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.6 advisory. - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. CVE-2026-106583 ...

EulerOS 2.0 SP13 : openssh (EulerOS-SA-2026-4077)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-60001 sshd in OpenSSH before 10.4 allows remote...

EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-4263)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line...

EulerOS 2.0 SP13 : openssh (EulerOS-SA-2026-4168)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-60001 sshd in OpenSSH before 10.4 allows remote...

EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-4353)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line...

CVE-2026-106555

A flaw was found in OpenSSH's SSH daemon sshd. When Generic Security Service Application Program Interface GSSAPI authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential...

SUSE CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

SUSE CVE-2026-106555

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

SUSE CVE-2026-106582

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings...

SUSE CVE-2026-106585

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

SUSE CVE-2026-106586

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

SUSE CVE-2026-106587

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled...

K000163605: OpenSSH vulnerabilities CVE-2026-73281, CVE-2026-73282, and CVE-2026-73283

Security Advisory Description CVE-2026-73281 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected]...

CLEANSTART-2026-NF19276 Improper certificate validation in Apache MINA SSHD (server-side)

Security vulnerability affects the wildfly package. Improper certificate validation in Apache MINA SSHD server-side...

Linux Distros Unpatched Vulnerability : CVE-2026-106588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH through 10.6, use of the macOS 27 or later SDK has the side effect of loss of sandboxing, which is potentially unexpected. CVE-2026-106588 No...

EulerOS 2.0 SP15 : openssh (EulerOS-SA-2026-3929)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts...

EulerOS 2.0 SP15 : openssh (EulerOS-SA-2026-3995)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts...

openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel,...