SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade etcdUpgrade rclone | Jan 26, 2026 | Nov 19, 2025 |
| Amazon Linux Ami 2 | — | Upgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade containerd-debuginfoUpgrade containerdUpgrade containerd-stressUpgrade dockerUpgrade nerdctl-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade runfinch-finchUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade docker-debugsourceUpgrade docker-debuginfoUpgrade docker | Jan 12, 2026 | Nov 19, 2025 |
| Freebsd | — | Upgrade oauth2-proxy | Jan 27, 2026 | Jan 18, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 19, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 9.4.12Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 10.0.4 | Jul 30, 2026 | Nov 19, 2025 |
| Ubuntu | — | Upgrade google-guest-agent (Ubuntu Pro)Upgrade google-guest-agent | Jan 14, 2026 | Nov 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub