Search CVE reports
1 – 10 of 571 results
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling...
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Not affected | Not affected | Not affected | Not affected | Not affected |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that...
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Not affected | Not affected | Not affected | Not affected | Not affected |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Not affected | Not affected | Not affected | Not affected | Not affected |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Not affected | Not affected | Not affected | Not affected | Not affected |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Not affected | Not affected | Not affected | Not affected | Not affected |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
Some fixes available 5 of 15
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Fixed | Fixed | Fixed | Needs evaluation | Needs evaluation |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
Some fixes available 5 of 15
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Fixed | Fixed | Fixed | Needs evaluation | Needs evaluation |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
Some fixes available 5 of 15
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Fixed | Fixed | Fixed | Needs evaluation | Needs evaluation |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
Some fixes available 5 of 15
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Fixed | Fixed | Fixed | Needs evaluation | Needs evaluation |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |
Some fixes available 5 of 15
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
3 affected packages
openssh, openssh-ssh1, openssh-gssapi
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| openssh | Fixed | Fixed | Fixed | Needs evaluation | Needs evaluation |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| openssh-gssapi | Not in release | Not in release | Not in release | — | — |