Openssh (Openbsd) - vulnerabilities (CVEs)

151 CVEs, 11 in the last 30 days, 301 known versions, newest CVE from 2026-10-06. Vendor: Openbsd.

CVEs of Openssh

CVE-2026-106583 - CVSS 7.8 (high), 2026-10-06: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-106589 - CVSS 2.9 (low), 2026-10-06: In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is…
CVE-2026-106588 - CVSS 3.1 (low), 2026-10-06: In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
CVE-2026-106587 - CVSS 3.6 (low), 2026-10-06: In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is…
CVE-2026-106586 - CVSS 4.3 (medium), 2026-10-06: In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different…
CVE-2026-106585 - CVSS 6.5 (medium), 2026-10-06: In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
CVE-2026-106584 - CVSS 3.3 (low), 2026-10-06: In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more…
CVE-2026-106582 - CVSS 3.7 (low), 2026-10-06: In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the…
CVE-2026-106555 - CVSS 7.5 (high), 2026-10-06: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
CVE-2026-106553 - CVSS 7.5 (high), 2026-10-06: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
CVE-2026-106552 - CVSS 6.5 (medium), 2026-10-06: In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy…
CVE-2026-73283 - CVSS 2.5 (low), 2026-08-11: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
CVE-2026-73282 - CVSS 4.8 (medium), 2026-08-11: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 - CVSS 3.5 (low), 2026-08-11: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use…
CVE-2026-60002 - CVSS 9.4 (critical), 2026-07-08: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
CVE-2026-60001 - CVSS 6.5 (medium), 2026-07-08: sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
CVE-2026-60000 - CVSS 7.5 (high), 2026-07-08: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because…
CVE-2026-59999 - CVSS 7.5 (high), 2026-07-08: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
CVE-2026-59998 - CVSS 6.5 (medium), 2026-07-08: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
CVE-2026-59997 - CVSS 5.4 (medium), 2026-07-08: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would…
CVE-2026-59996 - CVSS 5.4 (medium), 2026-07-08: scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
CVE-2026-59995 - CVSS 5.4 (medium), 2026-07-08: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
CVE-2026-55654 - CVSS 3.7 (low), 2026-06-23: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application…
CVE-2026-55655 - CVSS 6.1 (medium), 2026-06-23: A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by…
CVE-2026-55653 - CVSS 6.5 (medium), 2026-06-23: A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This…
CVE-2026-35414 - CVSS 8.1 (high), 2026-04-02: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate…
CVE-2026-35386 - CVSS 8.1 (high), 2026-04-02: In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username…
CVE-2026-35385 - CVSS 8.1 (high), 2026-04-02: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is…
CVE-2026-35388 - CVSS 2.5 (low), 2026-04-02: OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CVE-2026-35387 - CVSS 6.5 (medium), 2026-04-02: OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is…
CVE-2026-3497 - CVSS 8.2 (high), 2026-03-12: Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux…
CVE-2025-61984 - CVSS 3.6 (low), 2025-10-06: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code…
CVE-2025-61985 - CVSS 3.6 (low), 2025-10-06: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVE-2025-32728 - CVSS 4.3 (medium), 2025-04-10: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
CVE-2025-26466 - CVSS 5.9 (medium), 2025-02-28: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of…
CVE-2025-26465 - CVSS 6.8 (medium), 2025-02-18: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine…
CVE-2024-39894 - CVSS 7.5 (high), 2024-07-02: OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an…
CVE-2024-6387 - CVSS 8.1 (high), 2024-07-01: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an…
CVE-2023-51767 - CVSS 7 (high), 2023-12-24: OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of…
CVE-2023-51385 - CVSS 6.5 (medium), 2023-12-18: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an…
CVE-2023-51384 - CVSS 5.5 (medium), 2023-12-18: In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of…
CVE-2023-48795 - CVSS 5.9 (medium), 2023-12-18: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks…
CVE-2023-38408 - CVSS 9.8 (critical), 2023-07-20: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is…
CVE-2023-28531 - CVSS 9.8 (critical), 2023-03-17: ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVE-2023-25136 - CVSS 6.5 (medium), 2023-02-03: OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be…
CVE-2021-36368 - CVSS 3.7 (low), 2022-03-13: An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an…
CVE-2021-41617 - CVSS 7 (high), 2021-09-26: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not…
CVE-2016-20012 - CVSS 5.3 (medium), 2021-09-15: OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test…
CVE-2021-28041 - CVSS 7.1 (high), 2021-03-05: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy…
CVE-2020-15778 - CVSS 7.8 (high), 2020-07-24: scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.…
CVE-2020-14145 - CVSS 5.9 (medium), 2020-06-29: The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows…
CVE-2020-12062 - CVSS 7.5 (high), 2020-06-01: The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged…
CVE-2019-16905 - CVSS 7.8 (high), 2019-10-09: OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is…
CVE-2019-6110 - CVSS 6.8 (medium), 2019-01-31: In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the…
CVE-2019-6109 - CVSS 6.8 (medium), 2019-01-31: An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can…
CVE-2019-6111 - CVSS 5.9 (medium), 2019-01-31: An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the…
CVE-2018-20685 - CVSS 5.3 (medium), 2019-01-10: In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The…
CVE-2018-15919 - CVSS 5.3 (medium), 2018-08-28: Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when…
CVE-2018-15473 - CVSS 5.9 (medium), 2018-08-17: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet…
CVE-2016-10708 - CVSS 7.5 (high), 2018-01-21: sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS…
CVE-2017-15906 - CVSS 5.3 (medium), 2017-10-26: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create…
CVE-2016-1908 - CVSS 9.8 (critical), 2017-04-11: The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control…
CVE-2016-6210 - CVSS 5.9 (medium), 2017-02-13: sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not…
CVE-2016-10011 - CVSS 6.2 (medium), 2017-01-05: authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain…
CVE-2016-10010 - CVSS 7 (high), 2017-01-05: sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain…
CVE-2016-10009 - CVSS 7.3 (high), 2017-01-05: Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by…
CVE-2016-10012 - CVSS 7.8 (high), 2017-01-05: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by…
CVE-2016-8858 - CVSS 7.5 (high), 2016-12-09: The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by…
CVE-2016-6515 - CVSS 7.5 (high), 2016-08-07: The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote…
CVE-2015-8325 - CVSS 7.8 (high), 2016-05-01: The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment…
CVE-2016-3115 - CVSS 6.4 (medium), 2016-03-22: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command…
CVE-2016-1907 - CVSS 5.3 (medium), 2016-01-19: The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and…
CVE-2016-0778 - CVSS 8.1 (high), 2016-01-14: The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and…
CVE-2016-0777 - CVSS 6.5 (medium), 2016-01-14: The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information…
CVE-2015-6565 - CVSS 7.2 (high), 2015-08-24: sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or…
CVE-2015-6564 - CVSS 7 (high), 2015-08-24: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local…
CVE-2015-6563 - CVSS 6.4 (medium), 2015-08-24: The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which…
CVE-2015-5600 - CVSS 8.1 (high), 2015-08-03: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices…
CVE-2015-5352 - CVSS 4.3 (medium), 2015-08-03: The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X…
CVE-2014-9278 - CVSS 4 (medium), 2014-12-06: The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in…
CVE-2014-2653 - CVSS 6.5 (medium), 2014-03-27: The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking…
CVE-2014-2532 - CVSS 4.9 (medium), 2014-03-18: sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment…
CVE-2011-4327 - CVSS 5.5 (medium), 2014-02-03: ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local…
CVE-2014-1692 - CVSS 7.3 (high), 2014-01-29: The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data…
CVE-2013-4548 - CVSS 6 (medium), 2013-11-08: The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a…
CVE-2010-5107 - CVSS 7.5 (high), 2013-03-07: The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it…
CVE-2011-5000 - CVSS 3.5 (low), 2012-04-05: The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated…
CVE-2012-0814 - CVSS 6.5 (medium), 2012-01-27: The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which…
CVE-2010-4755 - CVSS 4 (medium), 2011-03-02: The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD…
CVE-2011-0539 - CVSS 7.5 (high), 2011-02-10: The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does…
CVE-2010-4478 - CVSS 9.8 (critical), 2010-12-06: OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to…
CVE-2009-2904 - CVSS 6.9 (medium), 2009-10-01: A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora…
CVE-2008-5161 - CVSS 3.7 (low), 2008-11-19: Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and…
CVE-2008-4109 - CVSS 5 (medium), 2008-09-18: A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that…
CVE-2008-3844 - CVSS 9.3 (critical), 2008-08-27: Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally…
CVE-2008-3259 - CVSS 1.2 (low), 2008-07-22: OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms…
CVE-2008-3234 - CVSS 6.5 (medium), 2008-07-18: sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by…
CVE-2008-1657 - CVSS 6.5 (medium), 2008-04-02: OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
CVE-2008-1483 - CVSS 6.9 (medium), 2008-03-24: OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another…
CVE-2007-3102 - CVSS 4.3 (medium), 2007-10-18: Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote…