{"id":"CVE-2026-110925","aliases":["BELL-CVE-2026-110925","EUVD-2026-101836","GHSA-h54q-2vm3-97qv","RHSA-2026:82247","UBUNTU-CVE-2026-110925"],"status":"rejected","title":"A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or...","description":"CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-10-14T10:32:42Z","modified":"2026-10-28T20:17:41Z","affected":[{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-sk-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-18","1:7.5p1-18ubuntu1","1:7.5p1-18ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-17","1:7.5p1-18"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110925","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553034","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82247","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h54q-2vm3-97qv"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-110925","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106586","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106583","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106587","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106582","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106584","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106585","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110923","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82247.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106552","tags":["advisory"]},{"url":"https://www.openssh.org/releasenotes.html#10.6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106582","tags":["advisory"]},{"url":"https://arxiv.org/abs/2609.07709","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106583","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106584","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106585","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106585","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106586","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106587","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110923","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110925","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110926","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110927","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-110925","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-110925","description":"CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.","status":"rejected","published":"2026-10-15T05:25:00.811Z","modified":"2026-10-21T06:47:55.382Z","updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-101836","description":"CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.","status":"published","published":"2026-10-15T05:25:00Z","modified":"2026-10-21T06:47:55Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:40.152045Z"}],"ghsa":[{"id":"GHSA-h54q-2vm3-97qv","title":"A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or...","description":"A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.","status":"published","published":"2026-10-15T06:30:44Z","modified":"2026-10-15T21:37:02Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:13:49.895192Z"}],"nvd":[{"id":"CVE-2026-110925","description":"Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.","status":"rejected","published":"2026-10-15T06:17:01.243Z","modified":"2026-10-21T07:17:17.537Z","updated_at":"2026-11-02T14:12:59.328869Z"}],"osv":[{"id":"BELL-CVE-2026-110925","title":"CVE-2026-110925 does not affect BellSoft software","status":"withdrawn","published":"2026-10-16T06:05:35.694677Z","modified":"2026-10-21T07:15:05.479733353Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"RHSA-2026:82247","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-14T10:32:42Z","modified":"2026-10-20T10:43:33.437440456Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-110925","description":"Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.","status":"published","published":"2026-10-15T06:17:00Z","modified":"2026-10-28T20:17:41.953300499Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"}]}}