CVE-2026-3497: Medium severity Canonical Ubuntu Linux vulnerability
Last updated 30 June 2026
Other sources
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpktdisconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use sshpacketdisconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u7Fixed in 1:9.2p1-2+deb12u10Fixed in 1:9.2p1-2+deb12u9Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.0p1-7+deb13u2Fixed in 1:10.4p1-2Fixed in 1:10.4p1-3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3497?
CVE-2026-3497 is classified as a moderate severity vulnerability affecting specific Linux distributions' GSSAPI implementation.
How do I fix CVE-2026-3497?
To fix CVE-2026-3497, patch your affected Linux distribution with the latest security updates provided by your vendor.
Which Linux distributions are affected by CVE-2026-3497?
CVE-2026-3497 affects various Linux distributions that have applied the specific GSSAPI patches.
What is the impact of CVE-2026-3497?
The impact of CVE-2026-3497 could lead to unauthorized access or denial of service through improper error handling in the GSSAPI implementation.
Is CVE-2026-3497 present in the OpenSSH upstream project?
No, CVE-2026-3497 does not affect the OpenSSH upstream project, as it pertains specifically to GSSAPI patches in Linux distributions.