Critical Security Flaw in OpenSSH Packages: Information Disclosure and Denial of Service
Summary
ALSA-2026:6462: Important: openssh security update. Affects openssh versions < 8.7p1-48.el9_7.alma.1. Fixed in 8.7p1-48.el9_7.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, essential for secure remote login and other secure network services. It is supported by various operating systems, including Linux and UNIX. The package includes core components necessary for both the OpenSSH client and server functionalities, making it a critical component for secure communications. However, a recent vulnerability has been identified that could compromise the security of systems using OpenSSH.
Vulnerability Detail
The vulnerability, identified as CVE-2026-3497, stems from uninitialized variables within the OpenSSH GSSAPI (Generic Security Services Application Program Interface). This flaw can lead to information disclosure or denial of service, potentially allowing attackers to exploit the vulnerability to gain unauthorized access to sensitive information or disrupt service availability. The issue affects multiple OpenSSH components, including the client, server, and associated utilities.
How To Fix
Minimum fixed version
8.7p1-48.el9_7.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the OpenSSH service by configuring firewall rules or disabling the GSSAPI authentication feature until the packages are updated. This can be done by editing the sshd_config file and setting 'GSSAPIAuthentication no'.
Conclusion
The OpenSSH security update addresses a critical vulnerability that could lead to information disclosure and denial of service. Users are strongly advised to update their packages to the latest patched versions to ensure the security and integrity of their systems. Regular monitoring and prompt updates are essential in maintaining a secure environment.
See every vulnerability recorded for openssh →
FAQ
CVE-2026-3497 is a vulnerability in OpenSSH that can lead to information disclosure or denial of service due to uninitialized variables in the GSSAPI.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file. Visit Vulert Scanner to check if your application is affected.
The risks include potential unauthorized access to sensitive information and service disruptions, which can impact system integrity and availability.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate vulnerabilities.
If immediate updates are not possible, consider implementing workarounds such as disabling GSSAPI authentication or restricting access to the OpenSSH service.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
