SUSE-SU-2026:24382-1

SUSE-SU-2026:24382-1 · Security update for openssh

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for openssh fixes the following issues: - CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044). - CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory (bsc#1271046). - CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048). - CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (bsc#1271049). - CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052). - CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053). - CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054). - CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange (bsc#1271055). - CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses (bsc#1275075). - CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free (bsc#1275074). - CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses (bsc#1275079).

Fix available

Published

2026-10-23T11:58:00Z

Updated

2026-10-27T17:23:19.462025353Z

Stack: system · network

Check your server →