Critical OpenSSH Vulnerability: Information Disclosure and Denial of Service
Summary
RLSA-2026:6463: Important: openssh security update. Affects openssh versions < 0:9.9p1-13.el10_1.rocky.0.1. Fixed in 0:9.9p1-13.el10_1.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure communication over unsecured networks. It is essential for remote server management and secure file transfers. The package includes both client and server components, making it a critical tool for system administrators and developers. However, it is susceptible to vulnerabilities that can compromise security, such as the recent issue identified in CVE-2026-3497.
Vulnerability Detail
The vulnerability in OpenSSH arises from uninitialized variables within the GSSAPI (Generic Security Services Application Program Interface) implementation. This flaw can lead to information disclosure or a denial of service, potentially allowing attackers to exploit the system's resources or access sensitive information. The technical implications of this vulnerability are significant, as it affects the integrity and confidentiality of the data transmitted over SSH connections.
How To Fix
Minimum fixed version
0:9.9p1-13.el10_1.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling GSSAPI authentication in your SSH configuration file (/etc/ssh/sshd_config) by adding or modifying the following line:
GSSAPIAuthentication no
After making this change, restart the SSH service with:
sudo systemctl restart sshd
Conclusion
The OpenSSH vulnerability CVE-2026-3497 poses a significant risk to systems using affected versions. It is crucial to update to the patched version to mitigate potential threats. Users should also consider temporary workarounds while planning for a complete fix.
See every vulnerability recorded for openssh →
FAQ
CVE-2026-3497 is a vulnerability in OpenSSH that can lead to information disclosure or denial of service due to uninitialized variables in the GSSAPI implementation.
The CVSS score for this vulnerability is 8.2, indicating it is critical and should be addressed promptly.
The vulnerability affects OpenSSH versions prior to 0:9.9p1-13.el10_1.rocky.0.1, particularly on Rocky Linux 10.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider disabling GSSAPI authentication as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
