ALSA-2026:88211: Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/opensshto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-askpassto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-cavsto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-clientsto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-keycatto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-ldapto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/openssh-serverto a version that resolves this vulnerability.Fixed in 8.0p1-34.el8_10 - Upgrade
Upgrade
almalinux/pam_ssh_agent_authto a version that resolves this vulnerability.Fixed in 0.10.3-8.34.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which OpenSSH components are covered by this update?
The advisory lists openssh, openssh-askpass, openssh-cavs, openssh-clients, openssh-keycat, openssh-ldap, openssh-server, and pam_ssh_agent_auth for AlmaLinux.
Which issues could affect systems using GSSAPI authentication?
CVE-2026-59998 concerns GSSAPIStrictAcceptorCheck behavior in Windows Active Directory, and CVE-2026-60000 concerns denial of service through excessive GSSAPI authentication attempts. The provided advisory does not state configuration prerequisites or mitigations.
What attack types are addressed by this update?
The listed fixes cover an SFTP security bypass, an Active Directory-related GSSAPI behavior issue, facilitated brute-force attacks due to insufficient authentication delay, denial of service through GSSAPI attempts, and a tunnel-forwarding restriction bypass.