OpenBSD OpenSSH vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202627

Newest CVEs

• CVE-2026-106583

  In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

  OpenBSD · OpenSSH

  Low2.5
• CVE-2026-106589

  In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is…

  OpenBSD · OpenSSH

  Low2.9
• CVE-2026-106588

  In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

  OpenBSD · OpenSSH

  Low3.1
• CVE-2026-106587

  In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is…

  OpenBSD · OpenSSH

  Low3.6
• CVE-2026-106586

  In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different…

  OpenBSD · OpenSSH

  Low2.5
• CVE-2026-106585

  In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

  OpenBSD · OpenSSH

  Medium6.5
• CVE-2026-106584

  In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more…

  OpenBSD · OpenSSH

  Low2.5
• CVE-2026-106582

  In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams"…

  OpenBSD · OpenSSH

  Low3.7
• CVE-2026-106555

  In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

  OpenBSD · OpenSSH

  Low2.2
• CVE-2026-106553

  In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

  OpenBSD · OpenSSH

  Low2.2