{"id":"CVE-2026-59999","aliases":["ALPINE-CVE-2026-59999","ALSA-2026:69129","ALSA-2026:69130","ALSA-2026:69266","AZL-92051","BELL-CVE-2026-59999","CLSA-2026-1784268052","CLSA-2026-1784725535","CLSA-2026-1784846159","CLSA-2026-1784846326","CLSA-2026-1784846496","CLSA-2026-1785317563","DEBIAN-CVE-2026-59999","EUVD-2026-42142","GHSA-gcm2-x6hm-q4h3","JLSEC-2026-1323","MGASA-2026-0521","OESA-2026-3349","OESA-2026-3350","OESA-2026-3351","OESA-2026-3352","OESA-2026-3428","RHSA-2026:37382","RHSA-2026:69129","RHSA-2026:69130","RHSA-2026:69266","RHSA-2026:76748","RHSA-2026:76993","RHSA-2026:80513","RLSA-2026:69129","RLSA-2026:69130","RLSA-2026:69266","ROOT-OS-DEBIAN-11-CVE-2026-59999","ROOT-OS-DEBIAN-12-CVE-2026-59999","SUSE-SU-2026:22978-1","SUSE-SU-2026:24382-1","SUSE-SU-2026:24478-1","SUSE-SU-2026:3605-1","SUSE-SU-2026:4907-1","UBUNTU-CVE-2026-59999","USN-8533-1","USN-8804-1","openSUSE-SU-2026:21477-1"],"status":"published","title":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00159,"percentile":0.05111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-348"],"published":"2026-07-08T00:13:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["10.3_p1-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssh","fixed_in":["9.8p1-9"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r13"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssh","fixed_in":["10.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["10.4_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r13"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssh","fixed_in":["10.4_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["10.4_p1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"openssh-client","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"openssh-server","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"openssh-sftp-server","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"openssh-tests","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"ssh","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"ssh-askpass-gnome","fixed_in":["1:7.9p1-10+deb10u4+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:10.4p1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSH_jll","fixed_in":["10.4.1+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"openssh","fixed_in":["1:8.4p1-5+deb11u7.aikido.10","1:8.4p1-5+deb11u7.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-openssh","fixed_in":["1:8.4p1-5+deb11u7.aikido.10","1:8.4p1-5+deb11u7.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openssh","fixed_in":["1:9.2p1-2+deb12u10.aikido.14","1:9.2p1-2+deb12u10.aikido.15","1:9.2p1-2+deb12u10.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openssh","fixed_in":["1:9.2p1-2+deb12u10.aikido.14","1:9.2p1-2+deb12u10.aikido.15","1:9.2p1-2+deb12u10.aikido.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssh","fixed_in":["1:7.6p1-4ubuntu0.7+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssh","fixed_in":["1:8.2p1-4ubuntu0.13+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssh","fixed_in":["1:8.9p1-3ubuntu0.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssh","fixed_in":["1:8.9p1-3ubuntu0.16+Fips3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu13.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu13.18+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssh","fixed_in":["1:10.2p1-2ubuntu3.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3_p1-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-27.el10_2.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9p1-11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.11.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-8.33.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8p1-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r13"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"10.4_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r13"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.4_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"10.4_p1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openssh-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openssh-sftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssh-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssh-sftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssh-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssh-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssh-sftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssh-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-10+deb10u4+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.4p1-1"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9"]},{"source":"osv","ecosystem":"Julia","package":"OpenSSH_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.4.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0p1-4.1.mga10"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2p1-39.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-46.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-17.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-17.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-22.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-sk-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4p1-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-keysign-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-8.11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-8.11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-8.11.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-8.33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-8.33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-8.33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-7.el10_0.5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-45.el9_6.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-27.el10_2.rocky.0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.9p1-11.el9_8.rocky.0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-33.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Debian:11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.4p1-5+deb11u7.aikido.10"},{"fixed":"1:8.4p1-5+deb11u7.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.4p1-5+deb11u7.aikido.10"},{"fixed":"1:8.4p1-5+deb11u7.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u10.aikido.14"},{"fixed":"1:9.2p1-2+deb12u10.aikido.15"},{"fixed":"1:9.2p1-2+deb12u10.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u10.aikido.14"},{"fixed":"1:9.2p1-2+deb12u10.aikido.15"},{"fixed":"1:9.2p1-2+deb12u10.aikido.16"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0p2-160000.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-slfo.1.1_7.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-159998.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.49.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssh8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-8.30.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssh8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-8.30.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2.3","1:7.2p2-4ubuntu2.fips.2.4.1","1:7.2p2-4ubuntu2.fips.2.4.2","1:7.2p2-4ubuntu2.fips.2.8.1","1:7.2p2-4ubuntu2.fips.2.10.1","1:7.2p2-4ubuntu2.fips.2.10.2","1:7.2p2-4ubuntu2.fips.2.10.3","1:7.2p2-4ubuntu2.fips.2.10.4","1:7.2p2-4ubuntu2.fips.2.10.5","1:7.2p2-4ubuntu2.fips.2.10.6","1:7.2p2-4ubuntu2.fips.2.10.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2","1:7.2p2-4ubuntu2.fips.2.2.1","1:7.2p2-4ubuntu2.fips.2.10.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+esm6"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2","1:7.6p1-4ubuntu0.3","1:7.6p1-4ubuntu0.5","1:7.6p1-4ubuntu0.6","1:7.6p1-4ubuntu0.7","1:7.6p1-4ubuntu0.7+esm1","1:7.6p1-4ubuntu0.7+esm2","1:7.6p1-4ubuntu0.7+esm3","1:7.6p1-4ubuntu0.7+esm4","1:7.6p1-4ubuntu0.7+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.9p1-10~ubuntu18.04.fips.0.1","1:7.9p1-10~ubuntu18.04.fips.0.2","1:7.9p1-10~ubuntu18.04.fips.0.3","1:7.9p1-10~ubuntu18.04.fips.0.4","1:7.9p1-10~ubuntu18.04.fips.0.5","1:7.9p1-10~ubuntu18.04.fips.0.6","1:7.9p1-10~ubuntu18.04.fips.0.7","1:7.9p1-10~ubuntu18.04.fips.0.8","1:7.9p1-10~ubuntu18.04.fips.0.9","1:7.9p1-10~ubuntu18.04.fips.0.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.9p1-10~ubuntu18.04.fips.0.1","1:7.9p1-10~ubuntu18.04.fips.0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+esm3"}]}],"versions":["1:8.0p1-6build1","1:8.1p1-1","1:8.1p1-5","1:8.2p1-4","1:8.2p1-4ubuntu0.1","1:8.2p1-4ubuntu0.2","1:8.2p1-4ubuntu0.3","1:8.2p1-4ubuntu0.4","1:8.2p1-4ubuntu0.5","1:8.2p1-4ubuntu0.7","1:8.2p1-4ubuntu0.8","1:8.2p1-4ubuntu0.9","1:8.2p1-4ubuntu0.10","1:8.2p1-4ubuntu0.11","1:8.2p1-4ubuntu0.12","1:8.2p1-4ubuntu0.13","1:8.2p1-4ubuntu0.13+esm1","1:8.2p1-4ubuntu0.13+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.2p1-4ubuntu0.fips.0.2.1","1:8.2p1-4ubuntu0.fips.0.4.0","1:8.2p1-4ubuntu0.fips.0.5.0","1:8.2p1-4ubuntu0.fips.0.7","1:8.2p1-4ubuntu0.fips.0.8","1:8.2p1-4ubuntu0.fips.0.9","1:8.2p1-4ubuntu0.fips.0.10","1:8.2p1-4ubuntu0.fips.0.11","1:8.2p1-4ubuntu0.fips.0.12","1:8.2p1-4ubuntu0.fips.0.13","1:8.2p1-4ubuntu0.fips.0.13.1","1:8.2p1-4ubuntu0.fips.0.13.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.2p1-4ubuntu0.fips.0.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7","1:8.9p1-3ubuntu0.10","1:8.9p1-3ubuntu0.11","1:8.9p1-3ubuntu0.13","1:8.9p1-3ubuntu0.14","1:8.9p1-3ubuntu0.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.9p1-3ubuntu0.4+Fips1","1:8.9p1-3ubuntu0.4+Fips3","1:8.9p1-3ubuntu1.fips.0~ppa3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16+Fips3"}]}],"versions":["1:8.9p1-3ubuntu0.4+Fips1","1:8.9p1-3ubuntu0.4+Fips3","1:8.9p1-3ubuntu0.6+Fips1","1:8.9p1-3ubuntu0.7+Fips1","1:8.9p1-3ubuntu0.10+Fips1","1:8.9p1-3ubuntu0.11+Fips1","1:8.9p1-3ubuntu0.13+Fips1","1:8.9p1-3ubuntu0.14+Fips1","1:8.9p1-3ubuntu0.15+Fips1","1:8.9p1-3ubuntu0.15+Fips3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3","1:9.6p1-3ubuntu13.4","1:9.6p1-3ubuntu13.5","1:9.6p1-3ubuntu13.7","1:9.6p1-3ubuntu13.8","1:9.6p1-3ubuntu13.9","1:9.6p1-3ubuntu13.11","1:9.6p1-3ubuntu13.12","1:9.6p1-3ubuntu13.13","1:9.6p1-3ubuntu13.14","1:9.6p1-3ubuntu13.15","1:9.6p1-3ubuntu13.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18+Fips1"}]}],"versions":["1:9.6p1-3ubuntu13.7+Fips1","1:9.6p1-3ubuntu13.12+Fips1","1:9.6p1-3ubuntu13.13+Fips1","1:9.6p1-3ubuntu13.14+Fips1","1:9.6p1-3ubuntu13.15+Fips1","1:9.6p1-3ubuntu13.16+Fips1","1:9.6p1-3ubuntu13.16+Fips2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.9p1-3ubuntu3","1:9.9p1-3ubuntu3.1","1:10.0p1-5ubuntu2","1:10.0p1-5ubuntu3","1:10.0p1-5ubuntu4","1:10.0p1-5ubuntu5","1:10.0p1-5ubuntu5.1","1:10.0p1-5ubuntu5.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-17"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-18","1:7.5p1-18ubuntu1","1:7.5p1-18ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.4"}]}],"versions":["1:10.0p1-5ubuntu5","1:10.2p1-2ubuntu1","1:10.2p1-2ubuntu3","1:10.2p1-2ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-17","1:7.5p1-18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7","1:8.9p1-3ubuntu0.10","1:8.9p1-3ubuntu0.11","1:8.9p1-3ubuntu0.13","1:8.9p1-3ubuntu0.14","1:8.9p1-3ubuntu0.15"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3","1:9.6p1-3ubuntu13.4","1:9.6p1-3ubuntu13.5","1:9.6p1-3ubuntu13.7","1:9.6p1-3ubuntu13.8","1:9.6p1-3ubuntu13.9","1:9.6p1-3ubuntu13.11","1:9.6p1-3ubuntu13.12","1:9.6p1-3ubuntu13.13","1:9.6p1-3ubuntu13.14","1:9.6p1-3ubuntu13.15","1:9.6p1-3ubuntu13.16"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.4"}]}],"versions":["1:10.0p1-5ubuntu5","1:10.2p1-2ubuntu1","1:10.2p1-2ubuntu3","1:10.2p1-2ubuntu3.2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.13+esm4"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11","1:6.6p1-2ubuntu2.12","1:6.6p1-2ubuntu2.13","1:6.6p1-2ubuntu2.13+esm1","1:6.6p1-2ubuntu2.13+esm2","1:6.6p1-2ubuntu2.13+esm3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.10+esm10"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6","1:7.2p2-4ubuntu2.7","1:7.2p2-4ubuntu2.8","1:7.2p2-4ubuntu2.10","1:7.2p2-4ubuntu2.10+esm1","1:7.2p2-4ubuntu2.10+esm2","1:7.2p2-4ubuntu2.10+esm3","1:7.2p2-4ubuntu2.10+esm4","1:7.2p2-4ubuntu2.10+esm5","1:7.2p2-4ubuntu2.10+esm6","1:7.2p2-4ubuntu2.10+esm7","1:7.2p2-4ubuntu2.10+esm8","1:7.2p2-4ubuntu2.10+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+esm6"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2","1:7.6p1-4ubuntu0.3","1:7.6p1-4ubuntu0.5","1:7.6p1-4ubuntu0.6","1:7.6p1-4ubuntu0.7","1:7.6p1-4ubuntu0.7+esm1","1:7.6p1-4ubuntu0.7+esm2","1:7.6p1-4ubuntu0.7+esm3","1:7.6p1-4ubuntu0.7+esm4","1:7.6p1-4ubuntu0.7+esm5"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+esm3"}]}],"versions":["1:8.0p1-6build1","1:8.1p1-1","1:8.1p1-5","1:8.2p1-4","1:8.2p1-4ubuntu0.1","1:8.2p1-4ubuntu0.2","1:8.2p1-4ubuntu0.3","1:8.2p1-4ubuntu0.4","1:8.2p1-4ubuntu0.5","1:8.2p1-4ubuntu0.7","1:8.2p1-4ubuntu0.8","1:8.2p1-4ubuntu0.9","1:8.2p1-4ubuntu0.10","1:8.2p1-4ubuntu0.11","1:8.2p1-4ubuntu0.12","1:8.2p1-4ubuntu0.13","1:8.2p1-4ubuntu0.13+esm1","1:8.2p1-4ubuntu0.13+esm2"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0p2-160000.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0p2-160000.7.1"}]}],"bundled":8}],"products":[{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/07/06/5","tags":["Mailing List","Release Notes","web","article"]},{"url":"https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2","tags":["Release Notes","web","article"]},{"url":"https://www.openssh.org/releasenotes.html#10.4p1","tags":["Release Notes","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59999","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gcm2-x6hm-q4h3","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59999","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69129","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59995","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59999","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73281","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73283","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497927","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497942","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514321","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514327","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514328","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-69129.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69130","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-69130.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69266","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-69266.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59999","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784268052.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60000","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1784725535.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1784846159.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1784846326.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1784846496.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1785317563.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59999.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59999","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0521.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35876","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FAMKD5T6664L7TA7EBJFLZB2RX3AQYZ/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8533-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2ZK2T3OFPOIBFAZQAJISQ7EML4PHYVB/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/12/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRB2YTKIEJGFGAKEXYAPCDQSKUFBEI7B/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8721-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8928-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59997","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59996","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3351","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3352","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60001","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37382","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59996","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59998","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-60001","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-60002","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59997","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-60000","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37382.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59995","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59996","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59997","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59998","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497942","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59999","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60000","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60001","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60002","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514328","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69129.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73281","tags":["advisory"]},{"url":"https://www.openssh.org/releasenotes.html#10.5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73282","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73283","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69130.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69266.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76748","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462351","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76748.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55653","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55655","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55655","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76993","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76993.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80513","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80513.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69129","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69130","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69266","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622978-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271044","tags":["report"]},{"url":"https://bugzilla.suse.com/1271046","tags":["report"]},{"url":"https://bugzilla.suse.com/1271048","tags":["report"]},{"url":"https://bugzilla.suse.com/1271049","tags":["report"]},{"url":"https://bugzilla.suse.com/1271052","tags":["report"]},{"url":"https://bugzilla.suse.com/1271053","tags":["report"]},{"url":"https://bugzilla.suse.com/1271054","tags":["report"]},{"url":"https://bugzilla.suse.com/1271055","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60002","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624382-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259462","tags":["report"]},{"url":"https://bugzilla.suse.com/1275074","tags":["report"]},{"url":"https://bugzilla.suse.com/1275075","tags":["report"]},{"url":"https://bugzilla.suse.com/1275079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73283","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624478-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263605-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264907-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8804-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-60000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-60001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-60002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73282","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T00:13:08.397Z","modified":"2026-07-08T13:07:51.541Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42142","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T00:13:08Z","modified":"2026-07-08T13:07:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:11.058935Z"}],"ghsa":[{"id":"GHSA-gcm2-x6hm-q4h3","title":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T03:30:27Z","modified":"2026-07-08T03:30:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T15:09:18.783285Z"}],"nvd":[{"id":"CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T01:16:29.01Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"ALPINE-CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T01:16:29.01Z","modified":"2026-10-01T02:17:49.371908561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-59999","status":"published","published":"2026-07-09T06:03:10.333485Z","modified":"2026-07-17T07:15:10.76406869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T00:13:08.397Z","modified":"2026-11-04T17:27:21.385768607Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-348"],"updated_at":"2026-11-04T17:42:12.951355Z"},{"id":"DEBIAN-CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T01:16:29.01Z","modified":"2026-10-26T12:02:35.89012Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"JLSEC-2026-1323","title":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-08-14T07:55:16.253Z","modified":"2026-08-14T08:13:47.288040171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-3349","title":"openssh security update","description":"An open source implementation of SSH protocol version 2\r\n\r\nSecurity Fix(es):\n\nsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \u0026quot;sftp server:/path .\u0026quot; is used with an attacker-controlled server.(CVE-2026-59995)\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)","status":"published","published":"2026-08-13T14:00:19Z","modified":"2026-08-16T01:45:10.750356956Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3350","title":"openssh security update","description":"An open source implementation of SSH protocol version 2\r\n\r\nSecurity Fix(es):\n\nsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \u0026quot;sftp server:/path .\u0026quot; is used with an attacker-controlled server.(CVE-2026-59995)\n\nscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.(CVE-2026-59996)\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)","status":"published","published":"2026-08-13T14:00:24Z","modified":"2026-08-16T01:45:10.699685328Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3351","title":"openssh security update","description":"An open source implementation of SSH protocol version 2\r\n\r\nSecurity Fix(es):\n\nsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \u0026quot;sftp server:/path .\u0026quot; is used with an attacker-controlled server.(CVE-2026-59995)\n\nscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.(CVE-2026-59996)\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)","status":"published","published":"2026-08-13T14:00:28Z","modified":"2026-08-16T01:45:10.781054847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3352","title":"openssh security update","description":"An open source implementation of SSH protocol version 2\r\n\r\nSecurity Fix(es):\n\nsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \u0026quot;sftp server:/path .\u0026quot; is used with an attacker-controlled server.(CVE-2026-59995)\n\nscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.(CVE-2026-59996)\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)","status":"published","published":"2026-08-13T14:00:32Z","modified":"2026-08-16T01:45:12.078594469Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3428","title":"openssh security update","description":"An open source implementation of SSH protocol version 2\r\n\r\nSecurity Fix(es):\n\nsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \u0026quot;sftp server:/path .\u0026quot; is used with an attacker-controlled server.(CVE-2026-59995)\n\nscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.(CVE-2026-59996)\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)\n\nsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.(CVE-2026-60000)\n\nsshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.(CVE-2026-60001)","status":"published","published":"2026-08-20T09:57:24Z","modified":"2026-08-20T10:15:10.858244558Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:37382","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-10T10:10:49Z","modified":"2026-10-20T10:08:04Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:69129","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2026-09-21T10:14:56Z","modified":"2026-10-15T10:24:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69130","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2026-09-22T10:19:49Z","modified":"2026-10-15T10:24:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69266","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2026-09-22T10:19:52Z","modified":"2026-10-15T10:25:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:76748","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2026-10-07T10:20:10Z","modified":"2026-10-17T10:20:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76993","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2026-10-07T10:20:18Z","modified":"2026-10-17T10:20:11Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:80513","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2026-10-14T10:31:49Z","modified":"2026-10-17T10:20:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:69129","title":"Important: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n\n* openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)\n\n* openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)\n\n* openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T12:08:07.529031Z","modified":"2026-09-22T12:30:02.649438461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69130","title":"Important: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n\n* openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)\n\n* openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)\n\n* openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T18:04:11.996091Z","modified":"2026-09-22T18:24:41.379930332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69266","title":"Important: openssh security, bug fix, and enhancement update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n\n* openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\nBug Fix(es) and Enhancement(s):\n\n* Incomplete backport of CVE-2023-38408 in Rocky Linux 8 openssh (JIRA:Rocky Linux-234763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T06:00:52.858812Z","modified":"2026-09-22T06:30:30.902956139Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-59999","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T01:16:00Z","modified":"2026-10-23T04:45:04.353487575Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:69129","title":"Important: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  \n\nSecurity Fix(es):  \n\n  * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n  * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n  * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)\n  * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)\n  * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:30:42.352825024Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69130","title":"Important: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  \n\nSecurity Fix(es):  \n\n  * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n  * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n  * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)\n  * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)\n  * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:32:32.074208251Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69266","title":"Important: openssh security, bug fix, and enhancement update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.  \n\nSecurity Fix(es):  \n\n  * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n  * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n  * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Incomplete backport of CVE-2023-38408 in AlmaLinux 8 openssh (JIRA:AlmaLinux-234763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:02:29.352201206Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-92051","title":"CVE-2026-59999 affecting package openssh for versions less than 9.8p1-9","description":"In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.","status":"published","published":"2026-07-08T01:16:29Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1784268052","title":"Fix CVE(s): CVE-2026-59999, CVE-2026-60000","description":"   * SECURITY UPDATE: pre-authentication denial of service via GSSAPI\n     - debian/patches/CVE-2026-60000.patch: discard GSSAPI error tokens in\n       auth2-gss.c instead of feeding them into the GSSAPI stack, and count\n       the failed attempt so GSSAPI auth is subject to MaxAuthTries\n     - CVE-2026-60000","status":"published","published":"2026-07-17T06:01:17Z","modified":"2026-10-26T09:31:47.208269533Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784725535","title":"Fix CVE(s): CVE-2026-59999, CVE-2026-60000","description":"   * SECURITY UPDATE: DisableForwarding did not override PermitTunnel\n     - debian/patches/CVE-2026-59999.patch: add options.disable_forwarding to\n       the PermitTunnel gate in server_request_tun() in serverloop.c so that\n       DisableForwarding=yes rejects tunnel-device forwarding as documented.\n     - CVE-2026-59999\n   * SECURITY UPDATE: GSSAPI userauth pre-auth resource DoS / MaxAuthTries bypass\n     - debian/patches/CVE-2026-60000.patch: discard the client error token in\n       input_gssapi_errtok() instead of feeding it to ssh_gssapi_accept_ctx(),\n       and record the failed attempt via userauth_finish() so GSSAPI auth is\n       subject to MaxAuthTries, in auth2-gss.c.\n     - CVE-2026-60000","status":"published","published":"2026-07-22T13:06:03Z","modified":"2026-10-26T09:32:05.527867872Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784846159","title":"openssh: Fix of 2 CVEs","description":"- CVE-2026-59999: make DisableForwarding=yes override PermitTunnel=yes in\n  server_request_tun() (upstream 8dfe7ed6)\n- CVE-2026-60000: count postponed GSSAPI attempts against MaxAuthTries by\n  finishing auth in input_gssapi_errtok(), fixing a pre-auth resource DoS\n  (upstream 5d04ca6a)","status":"published","published":"2026-07-23T22:36:26Z","modified":"2026-10-26T09:31:55.814120808Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784846326","title":"openssh: Fix of 2 CVEs","description":"- CVE-2026-59999: make DisableForwarding=yes override PermitTunnel=yes in\n  server_request_tun() (upstream 8dfe7ed6)\n- CVE-2026-60000: count postponed GSSAPI attempts against MaxAuthTries by\n  finishing auth in input_gssapi_errtok(), fixing a pre-auth resource DoS\n  (upstream 5d04ca6a)","status":"published","published":"2026-07-23T22:39:13Z","modified":"2026-10-26T09:31:42.515282893Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784846496","title":"openssh: Fix of 2 CVEs","description":"- CVE-2026-59999: make DisableForwarding=yes override PermitTunnel=yes in\n  server_request_tun() (upstream 8dfe7ed6)\n- CVE-2026-60000: count postponed GSSAPI attempts against MaxAuthTries by\n  finishing auth in input_gssapi_errtok(), fixing a pre-auth resource DoS\n  (upstream 5d04ca6a)","status":"published","published":"2026-07-23T22:42:02Z","modified":"2026-10-26T09:31:58.334934408Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785317563","title":"Fix CVE(s): CVE-2026-59999","description":"   * SECURITY UPDATE: DisableForwarding did not override PermitTunnel\n     - debian/patches/CVE-2026-59999.patch: reject tunnel-device forwarding\n       requests in server_request_tun() (serverloop.c) when DisableForwarding\n       is set, so it takes precedence over PermitTunnel.\n     - CVE-2026-59999","status":"published","published":"2026-07-29T09:32:54Z","modified":"2026-10-26T09:31:52.915798466Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"MGASA-2026-0521","title":"Updated openssh packages fix security vulnerabilities","description":"Local mitm of x11 forwarding via abstract unix socket pre-binding in Red\nHat Enterprise Linux openssh client versions. (CVE-2026-55655)\nsftp in OpenSSH before 10.4 does not properly constrain the location of\ndownloaded files when \"sftp server:/path .\" is used with an\nattacker-controlled server. (CVE-2026-59995)\nscp in OpenSSH before 10.4 may place a file in the parent directory of\nan intended directory when the copy occurs between two remote\ndestinations. (CVE-2026-59996)\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9\ncommand-line arguments, which can be important if a later command-line\nargument would have helped to ensure the intended security properties of\nan SFTP connection. (CVE-2026-59997)\nsshd in OpenSSH before 10.4 has an undocumented security-relevant\nbehavior: GSSAPIStrictAcceptorCheck has no value if the server is in\nWindows Active Directory. (CVE-2026-59998)\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to\ntake precedence over PermitTunnel=yes, but did not. (CVE-2026-59999)\nsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of\nservice (resource consumption from excessive authentication attempts)\nbecause MaxAuthTries was mishandled for GSSAPIAuthentication.\n(CVE-2026-60000)\nsshd in OpenSSH before 10.4 does not always honor the minimum\nauthentication delay. (CVE-2026-60001)\nssh in OpenSSH before 10.4 can have a use-after-free when a server\nchanges its host key during a key re-exchange. (This outcome occurs only\non the client side.). (CVE-2026-60002)\nIn ssh-agent in OpenSSH before 10.5, some operations can occur remotely\nbut were intended to occur only locally, including operations that add\ntokens or use keys. This is caused by misinteraction between agent\nlocking and the session-bind@openssh.com extension. (CVE-2026-73281)\nIn ssh in OpenSSH before 10.5, a use-after-free for realloc data can\noccur if a certain pair of remote-forwarding operations are concurrent.\n(CVE-2026-73282)\nIn sshd in OpenSSH before 10.5, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not. (CVE-2026-73283)\nIn sftp in OpenSSH before 10.6, a server can trigger directory traversal\n(causing files to be written to unintended locations) during a recursive\ncopy operation. (CVE-2026-106552)\nIn sshd in OpenSSH before 10.6, credentials can incorrectly persist\nafter failure of a GSSAPIAuthentication authentication attempt.\n(CVE-2026-106553)\nIn sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication\nstate can incorrectly be persisted across authentication attempts.\n(CVE-2026-106555)\nIn sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be\nused even though this is contraindicated by the arXiv 2609.07709\n\"Crossing the Streams\" findings. (CVE-2026-106582)\nIn ssh in OpenSSH before 10.6, a $ or \\ character can occur in a\ncommand-line username, leading to injection. (CVE-2026-106583)\nIn ssh-keygen in OpenSSH before 10.6, certificates could have incorrect\nexpiration times because of Daylight Saving mishandling. There can be a\nslightly more severe effect on users in certain Antarctic locations.\n(CVE-2026-106584)\nIn sshd and ssh in OpenSSH before 10.6, there is no check for whether\nthe maximum packet length is exceeded during decompression of highly\ncompressed data. (CVE-2026-106585)\nIn sshd in OpenSSH before 10.6, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not, a different vulnerability than CVE-2026-73283.\n(CVE-2026-106586)\nIn sshd in OpenSSH before 10.6, the value \"none\" for a configuration\noption is sometimes interpreted as a filename but was intended to mean\nthat a feature is disabled. (CVE-2026-106587)\n","status":"published","published":"2026-10-19T16:59:00Z","modified":"2026-10-19T17:13:38.453313742Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21477-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2026-59995: sftp: location of downloaded files not properly constrained when `sftp server:/path .` is used with\n  an attacker-controlled server (bsc#1271044).\n- CVE-2026-59996: scp: file placed in the parent directory of an intended target directory when copy occurs between two\n  remote destinations (bsc#1271046).\n- CVE-2026-59997: sshd: `internal-sftp` command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: undocumented security-relevant `GSSAPIStrictAcceptorCheck` behavior in Windows Active Directory\n  is not documented (bsc#1271049).\n- CVE-2026-59999: sshd: `DisableForwarding=yes` does not override `PermitTunnel=yes` (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: minimum authentication delay is not honored (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","status":"published","published":"2026-07-29T08:09:56Z","modified":"2026-07-31T18:24:08.030039861Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-59999","title":"CVE-2026-59999 in openssh - Patched by Root","description":"Root has patched CVE-2026-59999 in the openssh package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:25:15Z","modified":"2026-08-23T10:19:43.346435314Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-59999","title":"CVE-2026-59999 in openssh - Patched by Root","description":"Root has patched CVE-2026-59999 in the openssh package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-19T08:24:56Z","modified":"2026-10-19T09:15:05.261671648Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"SUSE-SU-2026:22978-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2026-59995: sftp: location of downloaded files not properly constrained when `sftp server:/path .` is used with\n  an attacker-controlled server (bsc#1271044).\n- CVE-2026-59996: scp: file placed in the parent directory of an intended target directory when copy occurs between two\n  remote destinations (bsc#1271046).\n- CVE-2026-59997: sshd: `internal-sftp` command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: undocumented security-relevant `GSSAPIStrictAcceptorCheck` behavior in Windows Active Directory\n  is not documented (bsc#1271049).\n- CVE-2026-59999: sshd: `DisableForwarding=yes` does not override `PermitTunnel=yes` (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: minimum authentication delay is not honored (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","status":"published","published":"2026-07-29T08:10:06Z","modified":"2026-08-04T18:23:42.033041615Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:24382-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).\n- CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory\n  (bsc#1271046).\n- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory\n  (bsc#1271049).\n- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n- CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses\n  (bsc#1275075).\n- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free\n  (bsc#1275074).\n- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses\n  (bsc#1275079).\n","status":"published","published":"2026-10-23T11:58:00Z","modified":"2026-10-27T17:23:19.462025353Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24478-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).\n- CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory\n  (bsc#1271046).\n- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory\n  (bsc#1271049).\n- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","status":"published","published":"2026-10-30T08:37:29Z","modified":"2026-11-04T17:23:18.63472044Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3605-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- Backported support for the mlkemx25519 key exchange from upstream (jsc#PED-16473).\n\n- CVE-2026-59995: sftp: location of downloaded files not properly constrained when `sftp server:/path .` is used with\n  an attacker-controlled server (bsc#1271044).\n- CVE-2026-59996: scp: file placed in the parent directory of an intended target directory when copy occurs between two\n  remote destinations (bsc#1271046).\n- CVE-2026-59997: sshd: `internal-sftp` command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: undocumented security-relevant `GSSAPIStrictAcceptorCheck` behavior in Windows Active Directory\n  is not documented (bsc#1271049).\n- CVE-2026-59999: sshd: `DisableForwarding=yes` does not override `PermitTunnel=yes` (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: minimum authentication delay is not honored (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","status":"published","published":"2026-08-13T06:35:44Z","modified":"2026-08-14T10:30:28.309632878Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4907-1","title":"Security update for openssh8.4","description":"This update for openssh8.4 fixes the following issues:\n\n- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).\n- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory\n  (bsc#1271049).\n- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","status":"published","published":"2026-10-26T07:21:05Z","modified":"2026-10-26T20:15:05.602812317Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8533-1","title":"openssh vulnerabilities","description":"It was discovered that OpenSSH sftp did not properly constrain the location\nof downloaded files when connecting to an attacker-controlled server. An\nattacker could possibly use this issue to write files to unintended\nlocations on the file system. (CVE-2026-59995)\n\nIt was discovered that OpenSSH scp could place files in the parent\ndirectory of the intended destination when copying between two remote\nhosts. An attacker could possibly use this issue to write files to\nunintended locations. (CVE-2026-59996)\n\nIt was discovered that OpenSSH internal-sftp only recognized the first nine\ncommand-line arguments, This could result in certain security-sensitive\narguments being ignored, contrary to expectations. (CVE-2026-59997)\n\nIt was discovered that OpenSSH had undocumented behaviour regarding the\nGSSAPIStrictAcceptorCheck option in environments using Windows Active\nDirectory. The documentation has been updated to clarify use of the option.\n(CVE-2026-59998)\n\nIt was discovered that OpenSSH did not properly enforce precedence of\nDisableForwarding=yes over PermitTunnel=yes in server configurations. This\ncould possibly result in intended network forwarding restrictions being\nbypassed, contrary to expectations. (CVE-2026-59999)\n\nIt was discovered that OpenSSH mishandled the MaxAuthTries limit for GSSAPI\nauthentication. A remote attacker could use this issue to perform excessive\nauthentication attempts. (CVE-2026-60000)\n\nIt was discovered that OpenSSH did not always honour the minimum\nauthentication delay. An attacker could possibly use this issue to perform\nbrute-force attacks more efficiently. (CVE-2026-60001)\n\nIt was discovered that the OpenSSH client had a use-after-free\nvulnerability when a server changed its host key during a key re-exchange.\nAn attacker able to intercept communications could possibly use this issue\nto execute arbitrary code or obtain sensitive information. (CVE-2026-60002)","status":"published","published":"2026-07-13T13:07:08Z","modified":"2026-07-13T20:44:42.041297264Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8804-1","title":"openssh vulnerabilities","description":"Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell\nmetacharacters in certain usernames. An attacker could possibly use this\nissue to execute arbitrary commands when certain non-default\nconfigurations were used, resulting in arbitrary code execution. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2026-35386)\n\nChristos Papakonstantinou discovered that OpenSSH incorrectly handled\nECDSA algorithm restrictions. An attacker could possibly use this issue\nto cause unintended ECDSA algorithms to be accepted, resulting in\nsecurity restrictions being bypassed. (CVE-2026-35387)\n\nVladimir Tokarev discovered that OpenSSH incorrectly handled certain\nprincipal restrictions in authorized_keys files. An attacker could\npossibly use this issue to bypass principal restrictions, resulting in\nunauthorized access. This issue only affected Ubuntu 14.04 LTS, Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-35414)\n\nIt was discovered that OpenSSH incorrectly handled downloaded file paths\nwhen using sftp with an untrusted server. An attacker could possibly use\nthis issue to write downloaded files outside the intended location,\nresulting in unauthorized file modification. (CVE-2026-59995)\n\nIt was discovered that OpenSSH incorrectly handled command-line\narguments in internal-sftp. An attacker could possibly use this issue to\ncause certain security-related arguments to be ignored, resulting in\nsecurity restrictions being bypassed. (CVE-2026-59997)\n\nIt was discovered that OpenSSH incorrectly handled\nGSSAPIStrictAcceptorCheck when used with Windows Active Directory. An\nattacker could possibly use this issue to bypass GSSAPI security\nrestrictions, resulting in unauthorized access. (CVE-2026-59998)\n\nIt was discovered that OpenSSH incorrectly handled forwarding\nrestrictions when DisableForwarding and PermitTunnel were used together.\nAn attacker could possibly use this issue to create tunnels despite\nforwarding being disabled, resulting in security restrictions being\nbypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04\nLTS. (CVE-2026-59999)\n\nIt was discovered that OpenSSH incorrectly handled authentication\nattempt limits when using GSSAPI authentication. An attacker could\npossibly use this issue to consume excessive system resources, resulting\nin a denial of service. (CVE-2026-60000)\n\nIt was discovered that OpenSSH did not always enforce the minimum\nauthentication delay. An attacker could possibly use this issue to\nperform authentication attempts more rapidly than intended, resulting in\nweakened brute-force protections. This issue only affected Ubuntu 20.04\nLTS. (CVE-2026-60001)\n\nIt was discovered that OpenSSH incorrectly handled certain concurrent\nremote forwarding operations. An attacker could possibly use this issue\nto trigger a use-after-free, resulting in a denial of service or\narbitrary code execution. (CVE-2026-73282)","status":"published","published":"2026-09-22T14:24:54Z","modified":"2026-09-22T23:11:51.286738574Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}