Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 381

Export CSV
CVE-2026-55655

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd Openssh Redhat
Products
Openssh Openssh Enterprise Linux and 12 more
CVE-2026-55653

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd Openssh Redhat
Products
Openssh Openssh Enterprise Linux and 12 more
CVE-2026-123158

openssh: OpenSSH: Password authentication bypass via password hash misinterpretation

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

CVSS 3.1 · 8.1 High EPSS 18.9% KEV · Listed
Vendors
Alpinelinux Openbsd
Products
Alpine Linux Openssh
CVE-2024-6387

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVSS 3.1 · 8.1 High EPSS 99.5% KEV · Not listed
Vendors
Almalinux Amazon Apple and 10 more
Products
Almalinux Amazon Linux Macos and 83 more
CVE-2026-55654

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd Openssh Redhat
Products
Openssh Openssh Enterprise Linux and 6 more
CVE-2026-118373

LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2025-26466

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVSS 3.1 · 5.9 Medium EPSS 38.7% KEV · Not listed
Vendors
Canonical Debian Openbsd and 1 more
Products
Ubuntu Linux Debian Linux Openssh and 3 more
CVE-2025-26465

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CVSS 3.1 · 6.8 Medium EPSS 7.7% KEV · Not listed
Vendors
Debian Netapp Openbsd and 1 more
Products
Debian Linux Active Iq Unified Manager Ontap and 7 more
CVE-2026-118371

LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2026-56101

OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openbsd
CVE-2026-106585

openssh: openssh: Denial of service via oversized decompressed packets

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106583

openssh: openssh: Command injection via unvalidated command-line username

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-3497

openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

CVSS 4.0 · 2.7 Low EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Openbsd and 2 more
Products
Ubuntu Linux Debian Linux Openssh and 2 more
CVE-2025-61985

openssh: From CVEorg collector

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2025-61984

openssh: From CVEorg collector

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2025-32728

openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Openbsd
Products
Debian Linux Openssh
CVE-2023-51767

openssh: authentication bypass via row hammer attack

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Openbsd Redhat
Products
Fedora Openssh Enterprise Linux
CVE-2023-51384

openssh: destination constraints only apply to first PKCS#11 key

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Openbsd
Products
Debian Linux Openssh