CVE-2026-35387: Medium severity OpenSSH OpenSSH vulnerability
Last updated 22 September 2026
Other sources
OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.8p1-8 - Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:9.2p1-2+deb12u10Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.5p1-1 - Upgrade
Upgrade
OpenSSHto a version that resolves this vulnerability.Fixed in 10.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35387?
CVE-2026-35387 is rated as a high-severity vulnerability due to its potential impact on cryptographic security.
How do I fix CVE-2026-35387?
To remediate CVE-2026-35387, upgrade OpenSSH to version 10.3 or later.
What should I know about the ECDSA algorithms in CVE-2026-35387?
CVE-2026-35387 indicates that unintended ECDSA algorithms can be used if they are improperly listed in configuration settings.
What versions of OpenSSH are affected by CVE-2026-35387?
OpenSSH versions prior to 10.3 are affected by CVE-2026-35387.
Is there a workaround for CVE-2026-35387?
A temporary workaround for CVE-2026-35387 is to review and adjust the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms settings.