CVE-2016-6210

CVE-2016-6210 affects OpenSSH sshd prior to 7.3. When SHA-256/512 is used for user password hashing, sshd can reveal valid usernames by measuring timing differences during authentication for non-existent users, enabling remote, unauthenticated user enumeration. Impact is information disclosure; e...

CVE-2016-10010

CVE-2016-10010 : When OpenSSH sshd runs with privilege separation disabled, forwarded Unix-domain sockets are created by root instead of the authenticated user, potentially allowing a local attacker to gain root privileges. This is a local-privilege-escalation issue tied to the serverloop/privsep...

CVE-2023-51384

OpenSSH CVE-2023-51384 affects ssh-agent before 9.6: when adding PKCS#11-hosted private keys with destination constraints, constraints are only applied to the first key even if the token returns multiple keys. This can lead to incorrect constraint handling and potential disclosure of sensitive ma...

CVE-2016-3115

OpenSSH CVE-2016-3115 affects sshd in OpenSSH prior to 7.2p2. The vulnerability arises from CRLF injection via crafted X11 forwarding data in session.c (related to do_authenticated1 and session_x11_req), allowing a remote authenticated user to bypass shell-command restrictions. In practice, affec...

CVE-2007-2768

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, can leak whether a target user exists by returning different responses if the account is configured for OTP. This is described for CVE-2007-2768 (OpenSSH 4.6 and earlier) and is related to CVE-2007-2243 in the IBM bulletin, whic...

CVE-2008-3259

OpenSSH vulnerability CVE-2008-3259 affects OpenSSH before 5.1. On affected platforms, when X11UseLocalhost is disabled, SSHD sets SO_REUSEADDR which can allow local users to hijack the X11 forwarding port by binding to a single IP address (demonstrated on HP-UX). The provided description notes t...

CVE-2016-10011

CVE-2016-10011 – OpenSSH sshd (OpenSSH before 7.4) : The vulnerability arises from how authfile.c handles realloc on buffer contents, potentially leaking host private key material to privilege-separated child processes. This is a local, privilege-edge case: an attacker with access to the privileg...

CVE-2008-1657

OpenSSH vulnerability CVE-2008-1657 affects OpenSSH 4.4 up to versions before 4.9. The issue allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file. Severity is medium (CVSS 2.0 base score 6.5) with network access, low attack compl...

CVE-2025-26466

CVE-2025-26466 describes a DoS in OpenSSH where a malicious client floods ping/pong packets, causing unbounded memory growth on the server. Connected IBM AIX advisory notes affected OpenSSH filesets and provides concrete fixes: openssh.base.client/server at OpenSSH versions 9.7.3013.1000 (and 9.9...

CVE-2008-5161

CVE-2008-5161 is an SSH CBC-mode CBC vulnerability where error handling in CBC-based ciphers could allow remote attackers to recover plaintext from arbitrary SSH ciphertext blocks. The vulnerability affects multiple SSH implementations including OpenSSH 4.7p1 and various SSH clients/servers (as l...

CVE-2007-4752

CVE-2007-4752 affects OpenSSH before 4.7. When OpenSSH fails to create an untrusted X11 cookie, it falls back to a trusted X11 cookie, allowing an X client to be treated as trusted and potentially enabling privilege escalation. The linked Nessus advisories cite OpenSSH pre-4.7 in multiple distrib...

CVE-2023-25136

OpenSSH sshd 9.1 contains a pre-authentication double-free in the handling of options.kex_algorithms, fixed in 9.2. Public reports note a remote, unauthenticated attacker could potentially jump to arbitrary addresses in sshd’s address space, with one third-party saying remote code execution is th...

CVE-2026-35386

OpenSSH CVE-2026-35386 affects OpenSSH before 10.3. The vulnerability allows potential command execution via shell metacharacters in a username supplied on the command line, requiring an untrusted username and a non-default ssh_config with a % in use. Connected advisories (OpenSSH

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, displaying a different response if the account exists (similar to CVE-2001-1483).

CVE-2002-0640

CVE-2002-0640 describes a buffer overflow in sshd of OpenSSH 2.3.1 through 3.3 during challenge/response authentication when PAMAuthenticationViaKbdInt is used, which may allow remote code execution. The description specifies vulnerable OpenSSH versions and the impact as arbitrary code execution ...

CVE-2003-0693

CVE-2003-0693 describes a buffer management error in OpenSSH prior to 3.7, in buffer_append_space, where freeing the incorrect amount of memory can corrupt the heap and enable remote code execution. This is a remote, unauthenticated vulnerability with a high impact (CVE-2003-0693). Connected advi...

CVE-2014-2653

CVE-2014-2653 affects the OpenSSH client (OpenSSH 6.6 and earlier). The issue is in the verify_host_key function in sshconnect.c, which allows a remote server to trigger skipping of SSHFP DNS RR checks by presenting an unacceptable HostCertificate. Public advisories across vendors (CentOS/RHEL, I...

CVE-2026-35388

OpenSSH (before 10.3) is affected by a vulnerability in proxy-mode multiplexing where the system omits connection multiplexing confirmation for multiplexing sessions. The issue is tied to OpenSSH’s proxy-mode multiplexing behavior and is described as a flaw in the handling of multiplexing confirm...

CVE-2014-2532

OpenSSH CVE-2014-2532 affects sshd prior to 6.6, where AcceptEnv lines with wildcards can be bypassed by using a substring before the wildcard, allowing remote attackers to bypass environment restrictions. Affected component: sshd in OpenSSH. Impact cited: potential info disclosure and environmen...

CVE-2006-5052

OpenSSH before 4.4 on some platforms is vulnerable to a remote attacker determining the validity of usernames via a GSSAPI authentication abort. The issue affects portable OpenSSH versions prior to 4.4 and is discussed in multiple advisories (e.g., RHSA-2007:0703, RHSA-2007:0540, and related OSS/...

CVE-2008-4109

CVE-2008-4109 refers to a Debian OpenSSH patch that, prior to specific package versions (e.g., 4.3p2-9etch3, 4.6p1-1, and equivalents in SUSE), used non-async-signal-safe functions in the login-timeout signal handler. This can cause a denial of service (connection slot exhaustion) via multiple lo...

CVE-2009-2904

CVE-2009-2904 is a local privilege-escalation flaw in OpenSSH related to a Red Hat modification of the ChrootDirectory feature. The issue affects OpenSSH 4.8 used by sshd in OpenSSH 4.3 on Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allowing a local user to gain privileges via hard links t...

CVE-2026-35387

OpenSSH before 10.3 is affected by CVE-2026-35387: when listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms, the client/server may misinterpret this as enabling all ECDSA algorithms. The result is the unintended use of ECDSA keys, with confidentiality impact lis...

CVE-2006-5794

The CVE-2006-5794 entry refers to an unspecified vulnerability in the sshd Privilege Separation Monitor of OpenSSH up to version 4.4/4.5 that weakens authentication verification and could allow bypass of authentication. As stated, exploitation is believed to require leveraging vulnerabilities in ...

CVE-2003-0786

The CVE-2003-0786 issue affects OpenSSH 3.7.1 and 3.7.1p1 where Privilege Separation being disabled causes the SSH1 PAM challenge/response authentication outcome to not be checked, enabling a remote attacker to potentially escalate privileges. The entry carries a BASE score of 10.0 (HIGH) with ne...

CVE-2026-59995

OpenSSH sftp (client) vulnerability CVE-2026-59995 affects OpenSSH versions older than 10.4. The issue arises when using SFTP with an attacker-controlled server and the command "sftp server:/path .", where the client does not properly constrain the location where downloaded files can be placed. T...

CVE-2026-60000

CVE-2026-60000 affects OpenSSH sshd prior to 10.4. The vulnerability arises from mishandling MaxAuthTries for GSSAPIAuthentication, enabling a remote attacker to cause denial of service via resource exhaustion from excessive authentication attempts. Impact is a server-wide DoS (availability loss)...

CVE-2001-0361

CVE-2001-0361 affects SSH v1.5 implementations, notably OpenSSH up to 2.3.0, AppGate, and ssh-1 up to 1.2.31, when configured in certain ways. The issue enables a remote attacker to decrypt and/or alter traffic via a Bleichenbacher attack on PKCS#1 version 1.5. The connected PT security entries (...

CVE-2002-0639

CVE-2002-0639 concerns an integer overflow in sshd of OpenSSH 2.9.9–3.3 that enables remote code execution during ChallengeResponseAuthentication when SKEY or BSD_AUTH are used. The connected data confirms the CVE exists and notes a related entry, CVE-2002-0390, was reserved as a duplicate of CVE...

CVE-2026-59999

CVE-2026-59999 affects OpenSSH sshd prior to 10.4, where the intended precedence of DisableForwarding=yes over PermitTunnel=yes did not hold. The available documents confirm the root cause is an ordering/precedence bug in sshd, but do not provide concrete details on affected product versions beyo...

CVE-2016-1907

OpenSSH vulnerability CVE-2016-1907 affects OpenSSH before 7.1p2, where ssh_packet_read_poll2 in packet.c allows remote attackers to trigger an out-of-bounds read and crash the application, causing denial of service. The issue is confirmed in multiple records (NVD entry description; IBM i bulleti...

CVE-2003-0190

CVE-2003-0190 affects OpenSSH-portable/OpenSSH 3.6.1p1 and earlier with PAM enabled. The vulnerability is a timing side‑channel: when a login attempts with a non-existent username, an error is returned immediately, allowing remote attackers to determine valid usernames. This is an information dis...

CVE-2002-0083

CVE-2002-0083 is described in the initial document as an off-by-one error in the OpenSSH channel code affecting OpenSSH 2.0–3.0.2 that can allow privilege escalation. The connected F5 advisory (K1648) references CAN-2002-0083 and labels it as an OpenSSH array overflow vulnerability, but does not ...

CVE-2026-59996

OpenSSH SCP flaw: OpenSSH versions before 10.4 allow a file to be placed in the parent directory of the target when copying between two remote destinations. Root cause is described in the OpenSSH release notes; remediation is to upgrade to OpenSSH 10.4p1 or later (fixed in 10.4p1). No exploit det...

CVE-2004-1653

CVE-2004-1653 concerns OpenSSH’s default setting that enables AllowTcpForwarding. The description states that with an anonymous access program such as AnonCVS, remote authenticated users could perform a port bounce, effectively using the SSH server as a proxy to reach internal services. The vulne...

CVE-2026-59997

The CVE affects OpenSSH’s internal-sftp helper invoked by sshd, where the process only parses the first 9 command-line arguments. This is tied to OpenSSH before version 10.4. According to the description, this could undermine intended security properties of an SFTP connection if a later argument ...

CVE-2001-0572

CVE-2001-0572 concerns the SSH protocols 1 and 2 as implemented in OpenSSH and other packages. The connected documents confirm concrete details: the issue enables a remote attacker to sniff and disclose information such as password lengths, the authentication method (RSA/DSA), the number of autho...

CVE-2006-0225

OpenSSH 4.2p1 scp is vulnerable to arbitrary command execution via filenames containing shell metacharacters or spaces, because such names are expanded twice during local-to-local copying. The impact is that a local attacker could cause arbitrary commands to execute with the privileges of the scp...

CVE-2008-1483

OpenSSH vulnerability CVE-2008-1483 affects multiple IBM hardware management and OpenSSH-enabled products (e.g., IBM DSA Preboot, IMM2, CMM). The issue arises when sshd sets the DISPLAY environment for forwarded X11 connections, allowing a local authenticated user to hijack another user’s forward...

CVE-2013-4548

CVE-2013-4548 affects OpenSSH sshd 6.2/6.3 when using AES-GCM. The bug is in mm_newkeys_from_blob (monitor_wrap.c) where memory for a MAC context isn’t initialized, allowing remote authenticated users to bypass ForceCommand and login-shell restrictions via crafted packet data. Several connected s...

CVE-2015-6565

OpenSSH CVE-2015-6565 affects sshd on OpenSSH 6.8 and 6.9, where world-writable TTY device permissions enable local attackers to disrupt terminals or escalate: exploitation is demonstrated in exploit-db for OpenSSH 6.8/6.9, showing local privilege escalation to a root shell via abusing PTY handli...

CVE-2003-1562

MODE C CVE-2003-1562 refers to a race condition in sshd/OpenSSH 3.6.1p2 and earlier, where with PermitRootLogin disabled and using PAM keyboard-interactive authentication, sshd does not insert a delay after a root password attempt. This timing discrepancy could enable remote attackers to infer wh...

CVE-2005-2798

Technical details about CVE-2005-2798 are not publicly available in the provided connected documents. No product/version specifics, impact details, or fixes are enumerated here. Monitor for official updates from vendors or security advisories.

CVE-2004-2760

CVE-2004-2760 concerns OpenSSH/sshd behavior in OpenSSH 3.5p1 where, if PermitRootLogin is disabled, the server closes the TCP connection immediately after a correct-root-password login attempt but leaves the connection open after an incorrect password. This creates observable differences in conn...

CVE-2026-3497

OpenSSH CVE-2026-3497 concerns a flaw in the GSSAPI Key Exchange patch applied by several Linux distributions, not in the upstream OpenSSH project. The bug occurs when sshpkt_disconnect() is used on an error and does not terminate the process, allowing an attacker to send an unexpected GSSAPI mes...

CVE-2001-0144

Technical details about CVE-2001-0144 are not provided in the connected documents. The Initial Description notes an SSH1 CRC-32 overflow issue, but no vendor/version/exploit data is supplied here. Monitor for updates and disclose when more info becomes public.

CVE-2005-2666

Technical details for CVE-2005-2666 are not provided in the connected documents. The supplied sources reference OpenSSH issues unrelated to this CVE. Monitor for future disclosures to confirm affected versions and fixes.

CVE-2000-0999

Technical details about CVE-2000-0999 are not provided in the connected documents. The initial description mentions format-string vulnerabilities in OpenBSD ssh but no affected versions, impact specifics, or remediation are given here. Monitor for updates.

CVE-2026-60001

Technical details are not publicly available in the provided documents for CVE-2026-60001. Monitor for updates.

CVE-2026-59998

OpenSSH sshd (CVE-2026-59998) affects builds before 10.4. The issue is an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server runs in Windows Active Directory. CVSS v3.1 base score 4.8 (Medium) and impact on confidentiality/integrity (Low) with net...