Skip to content
Fencer Vulns
low 3.7

CVE-2026-55654 json

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

published 2026-06-23 4 mo ago modified 2026-11-06 2 d ago also EUVD-2026-38414

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:9.9p1-25.el10_2
  • Red Hat Red Hat Enterprise Linux 9 0:9.9p1-9.el9_8
  • Red Hat Red Hat Hardened Images 10.3p1-6.hum1
  • Red Hat Red Hat Update Infrastructure 5 1786435483, 1786533529, 1787135742, 1787241260
  • openssh Debian 14 1:10.4p1-5

debian advisories DEBIAN-CVE-2026-55654

  • openssh RHEL 10.2 9.9p1-25.el10_2
  • openssh-keycat RHEL 10.2 9.9p1-25.el10_2
  • openssh-server RHEL 10.2 9.9p1-25.el10_2
  • openssh-askpass RHEL 10.2 9.9p1-25.el10_2
  • openssh-clients RHEL 10.2 9.9p1-25.el10_2
  • openssh-keysign RHEL 10.2 9.9p1-25.el10_2
  • openssh RHEL 9 9.9p1-9.el9_8
  • openssh-keycat RHEL 9 9.9p1-9.el9_8

red hat advisories RHSA-2026:47757RHSA-2026:47756RHSA-2026:36759

  • openssh AlmaLinux 9 9.9p1-9.el9_8.alma.1
  • openssh-keycat AlmaLinux 9 9.9p1-9.el9_8.alma.1
  • openssh-server AlmaLinux 9 9.9p1-9.el9_8.alma.1
  • openssh-askpass AlmaLinux 9 9.9p1-9.el9_8.alma.1
  • openssh-clients AlmaLinux 9 9.9p1-9.el9_8.alma.1
  • pam_ssh_agent_auth AlmaLinux 9 0.10.4-7.9.el9_8.alma.1
  • openssh AlmaLinux 10 9.9p1-25.el10_2.alma.1
  • openssh-keycat AlmaLinux 10 9.9p1-25.el10_2.alma.1

almalinux advisories ALSA-2026:47756ALSA-2026:47757

  • openssh Rocky Linux 9 9.9p1-9.el9_8.rocky.0.1
  • openssh Rocky Linux 10 9.9p1-25.el10_2.rocky.0.1

rocky linux advisories RLSA-2026:47756RLSA-2026:47757

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55654 updated cvss 3.7

openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination

  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass 9.9p1-9.el9_8, pam_ssh_agent_auth 0.10.4-7.9.el9_8
    fixed: vendor fix RHSA-2026:47756
  • Red Hat Enterprise Linux AppStream (v. 10) openssh-askpass 9.9p1-25.el10_2, openssh-keysign 9.9p1-25.el10_2
    fixed: vendor fix RHSA-2026:47757
  • Red Hat Enterprise Linux BaseOS (v. 9) openssh 9.9p1-9.el9_8, openssh-keycat 9.9p1-9.el9_8, openssh-server 9.9p1-9.el9_8, openssh-clients 9.9p1-9.el9_8
    fixed: vendor fix RHSA-2026:47756
  • Red Hat Enterprise Linux BaseOS (v. 10) openssh 9.9p1-25.el10_2, openssh-keycat 9.9p1-25.el10_2, openssh-server 9.9p1-25.el10_2, openssh-clients 9.9p1-25.el10_2
    fixed: vendor fix RHSA-2026:47757
  • Red Hat Hardened Images openssh 10.3p1-6.hum1, openssh-keycat 10.3p1-6.hum1, openssh-server 10.3p1-6.hum1, openssh-askpass 10.3p1-6.hum1, openssh-clients 10.3p1-6.hum1, openssh-keysign 10.3p1-6.hum1, +1 more
    fixed: vendor fix RHSA-2026:36759
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9 1786533529, rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-rhel9 1786435483, rhui5/installer-tp-rhel9 1787135742
    fixed: vendor fix RHSA-2026:54387
  • Red Hat Enterprise Linux 6 openssh, openssh-ldap, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_auth Red Hat Enterprise Linux 7 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +3 more Red Hat Enterprise Linux 8 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +2 more Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1786533457, rhui5/cds-tp-rhel9 1787241206, rhui5/haproxy-rhel9 1786533449, rhui5/cds-kubernetes-rhel9 1786435241, rhui5/cds-kubernetes-tp-rhel9 1787241211
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2462493 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.