SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade etcd | Jan 26, 2026 | Nov 19, 2025 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade nerdctl-debuginfoUpgrade containerd-stressUpgrade containerdUpgrade containerd-debuginfoUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade docker-debuginfoUpgrade runfinch-finch | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade dockerUpgrade docker-debuginfoUpgrade nerdctlUpgrade amazon-cloudwatch-agentUpgrade runfinch-finchUpgrade docker-debugsource | Jan 12, 2026 | Nov 19, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Jan 27, 2026 | Jan 18, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 19, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 9.4.12Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 10.2.1 | Jul 30, 2026 | Nov 19, 2025 |
| Ubuntu | — | Upgrade google-guest-agentUpgrade google-guest-agent (Ubuntu Pro) | Jan 14, 2026 | Nov 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub