Every CVE Search/ Get API key

CVE-2026-55654

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

3.7 LowFix available

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.65%Up 0.3 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-06
EUVDEUVD-2026-38414 3.7

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
EUVD-2026-38414
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-5mx2-7g4j-9m39 3.7

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the...

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
GHSA-5mx2-7g4j-9m39
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 3.7

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-06
OSVBELL-CVE-2026-55654 3.7

CVE-2026-55654 does not affect BellSoft software

Record
BELL-CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 3.7

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-07
Show 9 moreShow less
OSVDEBIAN-CVE-2026-55654 3.7

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
DEBIAN-CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-07
OSVRHSA-2026:36759 5.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:36759
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:47756 7.7

Red Hat Security Advisory: openssh security update

Record
RHSA-2026:47756
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:47757 7.7

Red Hat Security Advisory: openssh security update

Record
RHSA-2026:47757
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2026:47756 7.7

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux OpenSSH client versions (CVE-2026-55655)

  • openssh: Double free in Rocky Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)

  • openssh: Heap out-of-bounds read in Rocky Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654)

  • openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)

  • openssh: OpenSSH: scp file misplacement vulnerability during remote copy (CVE-2026-59996)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47756
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2026:47757 7.7

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux OpenSSH client versions (CVE-2026-55655)

  • openssh: Double free in Rocky Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)

  • openssh: Heap out-of-bounds read in Rocky Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654)

  • openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)

  • openssh: OpenSSH: scp file misplacement vulnerability during remote copy (CVE-2026-59996)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47757
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55654 3.7

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Record
UBUNTU-CVE-2026-55654
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:47756 No score

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655)
  • openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)
  • openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654)
  • openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
  • openssh: OpenSSH: scp file misplacement vulnerability during remote copy (CVE-2026-59996)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47756
Updated
2026-11-02
OSVALSA-2026:47757 No score

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655)
  • openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)
  • openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654)
  • openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
  • openssh: OpenSSH: scp file misplacement vulnerability during remote copy (CVE-2026-59996)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47757
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
AlmaLinux:9
From an advisory covering 5 CVEs
 before 9.9p1-9.el9_8.alma.1
9.9p1-9.el9_8.alma.1
openssh-askpass
AlmaLinux:9
From an advisory covering 5 CVEs
 before 9.9p1-9.el9_8.alma.1
9.9p1-9.el9_8.alma.1
openssh-clients
AlmaLinux:9
From an advisory covering 5 CVEs
 before 9.9p1-9.el9_8.alma.1
9.9p1-9.el9_8.alma.1
openssh-keycat
AlmaLinux:9
From an advisory covering 5 CVEs
 before 9.9p1-9.el9_8.alma.1
9.9p1-9.el9_8.alma.1
openssh-server
AlmaLinux:9
From an advisory covering 5 CVEs
 before 9.9p1-9.el9_8.alma.1
9.9p1-9.el9_8.alma.1
pam_ssh_agent_auth
AlmaLinux:9
From an advisory covering 5 CVEs
 before 0.10.4-7.9.el9_8.alma.1
0.10.4-7.9.el9_8.alma.1
openssh
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
openssh-askpass
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
openssh-clients
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
openssh-keycat
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
Show 58 moreShow less
Affected packages
PackageAffectedFixed
openssh-keysign
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
openssh-server
AlmaLinux:10
From an advisory covering 5 CVEs
 before 9.9p1-25.el10_2.alma.1
9.9p1-25.el10_2.alma.1
openssh
Debian:13
 All versions, plus listed versions
1:10.0p1-71:10.0p1-7+deb13u11:10.0p1-7+deb13u21:10.0p1-7+deb13u31:10.0p1-7+deb13u4
Show 28 moreShow less
1:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1
 None known
openssh
Debian:14
 before 1:10.4p1-5, plus listed versions
1:10.0p1-71:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-1
Show 20 moreShow less
1:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-4
1:10.4p1-5
openssh-gssapi
Debian:14
 All versions, plus listed versions
1:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1
 None known
openssh
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-askpass
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-clients
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-keycat
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-keysign
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-server
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-sk-dummy
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.3p1-6.hum1
0:10.3p1-6.hum1
openssh-askpass
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-askpass-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-clients-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-keycat-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-server-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-sk-dummy-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
pam_ssh_agent_auth
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:0.10.4-7.9.el9_8
0:0.10.4-7.9.el9_8
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:0.10.4-7.9.el9_8
0:0.10.4-7.9.el9_8
openssh
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-askpass-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-clients
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-clients-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-keycat
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-keycat-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-server
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-server-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
openssh-sk-dummy-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8
0:9.9p1-9.el9_8
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 5 CVEs
 before 0:0.10.4-7.9.el9_8
0:0.10.4-7.9.el9_8
openssh-askpass
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-askpass-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-clients-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-keycat-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-keysign
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-keysign-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-server-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-sk-dummy-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-clients
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-keycat
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh-server
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2
0:9.9p1-25.el10_2
openssh
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:9.9p1-9.el9_8.rocky.0.1
0:9.9p1-9.el9_8.rocky.0.1
openssh
Rocky Linux:10
From an advisory covering 5 CVEs
 before 0:9.9p1-25.el10_2.rocky.0.1
0:9.9p1-25.el10_2.rocky.0.1
openssh-ssh1
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-10
 None known
openssh-ssh1
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:7.5p1-11build1
 None known
openssh-ssh1
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:7.5p1-121:7.5p1-12build11:7.5p1-13
 None known
openssh-ssh1
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16
 None known
openssh
Ubuntu:25.10
 All versions, plus listed versions
1:9.9p1-3ubuntu31:9.9p1-3ubuntu3.11:10.0p1-5ubuntu21:10.0p1-5ubuntu31:10.0p1-5ubuntu41:10.0p1-5ubuntu51:10.0p1-5ubuntu5.11:10.0p1-5ubuntu5.4
 None known
openssh-ssh1
Ubuntu:25.10
 All versions, plus listed versions
1:7.5p1-17
 None known
openssh-ssh1
Ubuntu:26.10
 All versions, plus listed versions
1:7.5p1-181:7.5p1-18ubuntu11:7.5p1-18ubuntu2
 None known
openssh-ssh1
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:7.5p1-171:7.5p1-18
 None known

History

History
RecordedChangedSources
affectedNVD, OSV
productsCVE List, EUVD
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55654 is a low vulnerability (CVSS 3.7) in Openbsd Openssh, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in openssh 1:10.4p1-5.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open