p PatchFirst

CVE-2026-55654

CVE-2026-55654 · Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

CVSS 3.7 · Low · EPSS 0.7% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:9.9p1-25.el10_2: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:9.9p1-9.el9_8: Not affected (rpm)

    No fix published

  • red hat hardened images

    Versions
    • ≥ 10.3p1-6.hum1: Not affected (rpm)

    No fix published

  • red hat update infrastructure 5

    Versions
    • ≥ 1786435483: Not affected (rpm)

    No fix published

  • red hat update infrastructure 5

    Versions
    • ≥ 1786533529: Not affected (rpm)

    No fix published

  • red hat update infrastructure 5

    Versions
    • ≥ 1787135742: Not affected (rpm)

    No fix published

  • red hat update infrastructure 5

    Versions
    • ≥ 1787241260: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat openshift container platform 4

    No fix published

  • openssh Debian:13

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-7+deb13u1
    • 1:10.0p1-7+deb13u2
    • 1:10.0p1-7+deb13u3
    • 1:10.0p1-7+deb13u4
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    • 1:10.4p1-5
    • 1:10.5p1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Debian:14

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    Affected ranges
    • ECOSYSTEM: < 1:10.4p1-5

    Update to 1:10.4p1-5

  • openssh-gssapi Debian:14

    Versions
    • 1:10.4p1-5
    • 1:10.5p1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:18.04:LTS

    Versions
    • 1:7.5p1-8
    • 1:7.5p1-9
    • 1:7.5p1-9build1
    • 1:7.5p1-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:20.04:LTS

    Versions
    • 1:7.5p1-11build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:22.04:LTS

    Versions
    • 1:7.5p1-12
    • 1:7.5p1-12build1
    • 1:7.5p1-13
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:24.04:LTS

    Versions
    • 1:7.5p1-14
    • 1:7.5p1-15
    • 1:7.5p1-15build1
    • 1:7.5p1-16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:25.10

    Versions
    • 1:9.9p1-3ubuntu3
    • 1:9.9p1-3ubuntu3.1
    • 1:10.0p1-5ubuntu2
    • 1:10.0p1-5ubuntu3
    • 1:10.0p1-5ubuntu4
    • 1:10.0p1-5ubuntu5
    • 1:10.0p1-5ubuntu5.1
    • 1:10.0p1-5ubuntu5.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:25.10

    Versions
    • 1:7.5p1-17
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:26.10

    Versions
    • 1:7.5p1-18
    • 1:7.5p1-18ubuntu1
    • 1:7.5p1-18ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:26.04:LTS

    Versions
    • 1:7.5p1-17
    • 1:7.5p1-18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →