| CVE-2026-78662 |
Previously, a channel registered in the mux's chanList is not usable until it is established
|
7.5
Élevée
|
2 sept. 2026 |
| CVE-2026-56855 |
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
|
7.5
Élevée
|
2 sept. 2026 |
| CVE-2026-56854 |
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
|
7.5
Élevée
|
28 août 2026 |
| CVE-2026-39834 |
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal…
|
9.1
Critique
|
22 mai 2026 |
| CVE-2026-46595 |
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
|
10.0
Critique
|
22 mai 2026 |
| CVE-2026-39827 |
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory…
|
6.5
Moyenne
|
22 mai 2026 |
| CVE-2026-39829 |
The RSA and DSA public key parsers did not enforce size limits on key parameters
|
7.5
Élevée
|
22 mai 2026 |
| CVE-2026-39830 |
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the…
|
9.1
Critique
|
22 mai 2026 |
| CVE-2026-39831 |
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did…
|
9.1
Critique
|
22 mai 2026 |
| CVE-2026-39835 |
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be…
|
5.3
Moyenne
|
22 mai 2026 |
| CVE-2026-46597 |
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for…
|
7.5
Élevée
|
22 mai 2026 |
| CVE-2026-39828 |
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were…
|
6.3
Moyenne
|
22 mai 2026 |
| CVE-2025-58181 |
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request,…
|
5.3
Moyenne
|
19 nov. 2025 |
| CVE-2025-22869 |
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which…
|
7.5
Élevée
|
26 févr. 2025 |
| CVE-2024-45337 |
Applications and libraries which misuse connection.serverAuthenticate (via callback field…
|
9.1
Critique
|
11 déc. 2024 |