Moderate Security Update for OpenSSH: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:85958: Moderate: openssh security update. Affects openssh versions < 9.9p1-13.el9_8.alma.1. Fixed in 9.9p1-13.el9_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure communication over unsecured networks. It includes essential components for both client and server operations, making it a critical tool for system administrators and users alike. The recent vulnerabilities identified in OpenSSH could potentially compromise the security of systems utilizing this software, particularly in environments relying on secure file transfers and authentication mechanisms.
Vulnerability Detail
The vulnerabilities in OpenSSH stem from several issues, including a security bypass in SFTP due to flawed command-line argument parsing (CVE-2026-59997), an undocumented behavior affecting GSSAPIStrictAcceptorCheck in Windows Active Directory (CVE-2026-59998), and a Denial of Service (DoS) vulnerability caused by excessive GSSAPI authentication attempts (CVE-2026-60000). These vulnerabilities could allow unauthorized access, impact system integrity, and lead to service disruptions.
How To Fix
Minimum fixed version
9.9p1-13.el9_8.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling GSSAPI authentication if it is not essential for your operations. This can be done by modifying the SSH configuration file (usually located at /etc/ssh/sshd_config) and setting the following option:
GSSAPIAuthentication no
After making this change, restart the SSH service using:
sudo systemctl restart sshd
Conclusion
The recent vulnerabilities in OpenSSH pose significant risks to systems relying on this software for secure communications. It is crucial to apply the recommended updates to mitigate these risks and ensure the integrity and security of your systems.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a network.
The main vulnerabilities include a security bypass in SFTP, issues with GSSAPIStrictAcceptorCheck, and a Denial of Service vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider disabling GSSAPI authentication as a temporary workaround.
For more details, refer to the CVE pages listed in the vulnerability report, which provide comprehensive information about each issue.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
