CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Score
CVSS 3.1 6.5 Medium
Status
Modified - secalert@redhat.com
Published
2026-06-23
Last modified
2026-10-26
Weaknesses
CWE-415

Affected products

References

 
 
© AVABIS GmbH privacypolicy about