In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-keysignUpgrade openssh-askpassUpgrade openssh | Oct 11, 2026 | Sep 21, 2026 |
| Alpine Linux | — | Upgrade openssh | Sep 1, 2026 | Aug 11, 2026 |
| Amazon_linux_2023 | — | Upgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-debugsourceUpgrade openssh-debuginfoUpgrade opensshUpgrade openssh-keycat-debuginfoUpgrade openssh-sk-dummyUpgrade openssh-clients-debuginfoUpgrade openssh-server-debuginfoUpgrade pam_ssh_agent_auth | Nov 2, 2026 | Aug 11, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory22 | Sep 14, 2026 | Sep 11, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.5 | Sep 23, 2026 | Aug 11, 2026 |
| Oracle_linux | — | Upgrade opensshUpgrade openssh-keysignUpgrade openssh-askpassUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-cavsUpgrade openssh-keycat | Oct 22, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade opensshUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-keysign-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-clientsUpgrade openssh-keycat-debuginfoUpgrade openssh-keysignUpgrade openssh-server-debuginfoNo solution existsUpgrade openssh-keycatUpgrade openssh-askpassUpgrade openssh-clients-debuginfoUpgrade openssh-ldap-debuginfoUpgrade openssh-ldapUpgrade openssh-askpass-debuginfoUpgrade openssh-debuginfoUpgrade openssh-cavs-debuginfoUpgrade openssh-cavsUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debugsource | Aug 19, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade openssh-askpass-debuginfoUpgrade openssh-keycatUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-askpassUpgrade openssh-ldap-debuginfoUpgrade openssh-debuginfoUpgrade openssh-keycat-debuginfoUpgrade opensshUpgrade openssh-cavs-debuginfoUpgrade openssh-cavsUpgrade openssh-serverUpgrade openssh-server-debuginfoUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-clients-debuginfoUpgrade openssh-debugsource | Sep 28, 2026 | Sep 22, 2026 |
| Ubuntu | — | Upgrade openssh-server (Ubuntu Pro)Upgrade openssh-client (Ubuntu Pro)Upgrade openssh-serverUpgrade openssh-client | Sep 14, 2026 | Sep 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 11, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub