| CVE-2026-78662 |
Previously, a channel registered in the mux's chanList is not usable until it is established
|
7.5
High
|
Sep 2, 2026 |
| CVE-2026-56855 |
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
|
7.5
High
|
Sep 2, 2026 |
| CVE-2026-56854 |
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
|
7.5
High
|
Aug 28, 2026 |
| CVE-2026-39834 |
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal…
|
9.1
Critical
|
May 22, 2026 |
| CVE-2026-46595 |
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
|
10.0
Critical
|
May 22, 2026 |
| CVE-2026-39827 |
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory…
|
6.5
Medium
|
May 22, 2026 |
| CVE-2026-39829 |
The RSA and DSA public key parsers did not enforce size limits on key parameters
|
7.5
High
|
May 22, 2026 |
| CVE-2026-39830 |
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the…
|
9.1
Critical
|
May 22, 2026 |
| CVE-2026-39831 |
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did…
|
9.1
Critical
|
May 22, 2026 |
| CVE-2026-39835 |
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be…
|
5.3
Medium
|
May 22, 2026 |
| CVE-2026-46597 |
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for…
|
7.5
High
|
May 22, 2026 |
| CVE-2026-39828 |
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were…
|
6.3
Medium
|
May 22, 2026 |
| CVE-2025-58181 |
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request,…
|
5.3
Medium
|
Nov 19, 2025 |
| CVE-2025-22869 |
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which…
|
7.5
High
|
Feb 26, 2025 |
| CVE-2024-45337 |
Applications and libraries which misuse connection.serverAuthenticate (via callback field…
|
9.1
Critical
|
Dec 11, 2024 |