Threat database

CVE-2026-106587 is a low-severity vulnerability in OpenSSH before version 10.6 where the configuration option value "none" is sometimes incorrectly interpreted as a filename instead of disabling a feature. This type confusion flaw can lead to unintended behavior in the sshd daemon.

An off-by-one error (CWE-193) in OpenSSH's ssh-keygen before version 10.6 causes certificates to have incorrect expiration times due to mishandling of Daylight Saving Time. This issue can have a slightly more severe effect on users in certain Antarctic locations. The vulnerability has a low CVSS score of 2.5 and does not impact confidentiality or availability, only integrity to a limited extent.

CVE-2026-106586 is a low-severity vulnerability in OpenSSH versions before 10.6 where the 'restrict' keyword in authorized_keys was intended to restrict tunnel forwarding but did not function as expected. This flaw represents an incorrect control flow implementation distinct from CVE-2026-73283.

CVE-2026-106582 is a low-severity vulnerability in OpenSSH versions before 10.6 where the use of an LZ77 dictionary coder creates a covert channel risk. This issue relates to CWE-514, involving unintended information flow. The vulnerability is based on findings from the arXiv paper 2609.07709 "Crossing the Streams". No known exploits are reported in the wild. The vulnerability affects OpenSSH versions from initial releases up to but not including 10.6.

CVE-2026-106555 is a low-severity vulnerability in OpenSSH versions before 10.6 where the GSSAPIAuthentication state can be incorrectly persisted across authentication attempts. This issue relates to incorrect resource transfer between security contexts during authentication. The vulnerability has a CVSS score of 2.2, indicating low impact, primarily affecting confidentiality with limited attack vector and complexity.

CVE-2026-106553 is a low-severity vulnerability in OpenSSH versions before 10.6 where credentials may persist incorrectly after a failed GSSAPIAuthentication attempt. This issue relates to improper resource handling during authentication failures.

CVE-2026-106552 is a medium severity vulnerability in OpenSSH before version 10.6. It involves a relative path traversal issue in the sftp component, which can be triggered by a server during a recursive copy operation, potentially causing files to be written to unintended locations.

CVE-2026-106583 is a low-severity vulnerability in OpenSSH before version 10.6 where the presence of a $ or \ character in a command-line username can lead to resource injection. This improper control of resource identifiers could allow injection attacks via crafted usernames. The vulnerability has a CVSS score of 2.5, indicating low impact, with limited integrity impact and no confidentiality or availability impact.

CVE-2026-106588 is a medium severity vulnerability in OpenSSH up to version 10.6 where using the macOS 27 (or later) SDK causes loss of sandboxing in sshd. This represents improper isolation or compartmentalization, potentially leading to reduced security boundaries.

CVE-2026-106589 is a least privilege violation vulnerability in OpenSSH through version 10.6. In certain environments such as QNX 6 and SCO OpenServer 5, the sshd-session process can unexpectedly run with root privileges due to issues related to GatewayPorts and StreamLocalForwarding configuration options and lack of support for file-descriptor passing and unprivileged PTY allocation. The vulnerability has a low CVSS score of 2.9 and is rated medium severity. No known exploits are reported in the wild. No patch information is provided.

CVE-2026-106585 is a medium severity vulnerability in OpenSSH versions before 10.6. It involves improper handling of highly compressed data during decompression in sshd and ssh, where no check is performed to ensure the maximum packet length is not exceeded. This can lead to data amplification issues.

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.