CVE-2026-55654: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
AI Analysis
Technical Summary
This vulnerability in OpenSSH arises from a heap out-of-bounds read triggered during the cleanup of GSSAPI indicators due to a missing NULL sentinel termination in the auth-indicators array. Exploitation requires specific configurations involving GSSAPI authentication and a Kerberos environment. Successful exploitation causes the SSH authentication path to abort, leading to denial of service. Red Hat has issued security advisories and updated OpenSSH packages (version 10.3p1-6.hum1) in their Hardened Images to remediate this flaw.
Potential Impact
The vulnerability allows a remote attacker to cause the SSH authentication process to crash, resulting in denial of service and impacting the availability of the SSH service. There is no confidentiality or integrity impact reported. The CVSS score is low (3.7) reflecting the limited impact and complexity of exploitation.
Mitigation Recommendations
Red Hat has released updated OpenSSH packages (openssh-10.3p1-6.hum1 and related RPMs) for their Hardened Images that address this vulnerability. Users should apply these updates as provided by Red Hat to remediate the issue. No alternative mitigations are indicated in the vendor advisory.
CVE-2026-55654: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
CVSS v3.1
Score 3.7low
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Hardened Images
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Enterprise Linux 6
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat OpenShift Container Platform 4
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in OpenSSH arises from a heap out-of-bounds read triggered during the cleanup of GSSAPI indicators due to a missing NULL sentinel termination in the auth-indicators array. Exploitation requires specific configurations involving GSSAPI authentication and a Kerberos environment. Successful exploitation causes the SSH authentication path to abort, leading to denial of service. Red Hat has issued security advisories and updated OpenSSH packages (version 10.3p1-6.hum1) in their Hardened Images to remediate this flaw.
Potential Impact
The vulnerability allows a remote attacker to cause the SSH authentication process to crash, resulting in denial of service and impacting the availability of the SSH service. There is no confidentiality or integrity impact reported. The CVSS score is low (3.7) reflecting the limited impact and complexity of exploitation.
Mitigation Recommendations
Red Hat has released updated OpenSSH packages (openssh-10.3p1-6.hum1 and related RPMs) for their Hardened Images that address this vulnerability. Users should apply these updates as provided by Red Hat to remediate the issue. No alternative mitigations are indicated in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-16T23:55:05.737Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-55654","vendor":"Red Hat"}]
Threat ID: 6a3a0366eed863c81e190b85
Added to database: 06/23/2026, 03:54:14 UTC
Last enriched: 08/13/2026, 13:38:00 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 207
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.