OpenSSH vulnerabilities

The auth_password function in sshd in OpenSSH before version 7.3 does not limit password lengths for authentication, allowing remote attackers to cause a denial of service via long strings.

The do_setup_env function in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program.

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection. This allows remote attackers to conduct brute-force attacks or cause denial of service via a long and duplicative list in the ssh -oKbdInteractiveDevices option.

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures. This may allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

A flaw was found in OpenSSH where the authorized_keys "restrict" keyword is not applied to tunnel forwarding. When PermitTunnel is enabled, a key restricted with "restrict" can still open a tunnel.

When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.

Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.

A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key.

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

The vulnerability in ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

OpenSSH 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Vulnerability in scp in OpenSSH through 8.3p1 allows command injection via the destination argument containing backtick characters. The vendor intentionally does not validate such arguments to avoid breaking existing workflows.

An issue was discovered in OpenSSH 7.9. Because the scp implementation derives from 1983 rcp, the server chooses which files and directories are sent to the client, while the scp client only performs cursory validation of the returned object name (only directory traversal attacks are prevented). A malicious scp server or Man-in-The-Middle attacker can overwrite arbitrary files in the scp client target directory, and with recursive operation (-r) can manipulate subdirectories, for example to overwrite .ssh/authorized_keys.

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol. This allows remote attackers to bypass the need for knowledge of the shared secret and successfully authenticate by sending crafted values in each round of the protocol.

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to apply to tunnel forwarding but was not enforced. This is a different vulnerability than CVE-2026-73283.

In sshd and ssh in OpenSSH before version 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times due to Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

In sftp in OpenSSH before version 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

In sshd in OpenSSH before 10.5, the 'restrict' keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

In OpenSSH before version 10.4, a use-after-free vulnerability exists in the SSH client during key re-exchange when a server changes its host key. This issue affects only the client side.

A vulnerability in OpenSSH before version 10.4 causes the sshd server to not always enforce the minimum authentication delay. This could allow an attacker to perform login attempts more quickly.

A vulnerability in OpenSSH before version 10.4 allows remote attackers to cause a denial of service (DoS) via excessive GSSAPI authentication attempts. The issue stems from improper handling of the MaxAuthTries limit for GSSAPIAuthentication.

In OpenSSH before version 10.4, the DisableForwarding=yes option did not override PermitTunnel=yes, allowing SSH tunneling despite forwarding being disabled.

In OpenSSH before version 10.4, an undocumented security-relevant behavior was found: the GSSAPIStrictAcceptorCheck parameter has no value when the server is in a Windows Active Directory environment.

A vulnerability in the internal-sftp server in sshd in OpenSSH before version 10.4 causes only the first 9 command-line arguments to be recognized. This can be significant if a later argument would have ensured the intended security properties of an SFTP connection.

A vulnerability in the scp tool in OpenSSH before version 10.4 may place a file in the parent directory of the intended directory when copying between two remote destinations.

A vulnerability in the SFTP client in OpenSSH before version 10.4 allows an attacker-controlled server to write downloaded files outside the intended target directory when using the "sftp server:/path ." command.

A flaw in OpenSSH allows a local unprivileged attacker to hijack forwarded X11 connections. The attack pre-binds the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input.

A heap out-of-bounds read flaw was found in OpenSSH during cleanup of GSSAPI indicators when a trailing NULL is missing in the auth-indicators array. A remote attacker, under specific configurations with GSSAPI authentication and a Kerberos environment, could exploit this to crash the SSH authentication path, causing a denial of service (DoS).

A double free vulnerability was found in OpenSSH in the Diffie-Hellman Group Exchange (DH-GEX) client path during FIPS mode known-group validation. A malicious SSH server can exploit this by sending crafted DH-GEX group parameters, causing client process termination and Denial of Service (DoS).

The RSA and DSA public key parsers did not enforce size limits on key parameters, allowing a DoS attack by sending a crafted key with an excessively large modulus or DSA parameter. Signature verification could take several minutes.

An authenticated SSH client that repeatedly opened channels rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

OpenSSH before version 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

OpenSSH before version 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions, potentially allowing unauthorized access.

In OpenSSH before version 10.3, listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to allow all ECDSA algorithms.

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in ssh_config.

In OpenSSH before 10.3, a file downloaded by scp may be installed with setuid or setgid bits if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Vulnerability in OpenSSH GSSAPI patches added by various Linux distributions. The use of sshpkt_disconnect() instead of ssh_packet_disconnect() does not terminate the process, allowing an attacker to send an unexpected GSSAPI message type during key exchange, leading to access of uninitialized variables and potential undefined behavior.