RHSA-2026:99573: Important: openssh security update
Important: openssh security update
Other sources
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.Security Fix(es): openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions (CVE-2026-55655) openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) openssh: openssh: Information disclosure via shared compression side-channel (CVE-2026-106582) openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication (CVE-2026-106553) openssh: openssh: Denial of service via oversized decompressed packets (CVE-2026-106585) openssh: openssh: Command injection via unvalidated command-line username (CVE-2026-106583) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Does this update address issues in both OpenSSH clients and servers?
Yes. The listed fixes include client-side issues affecting X11 forwarding, DH-GEX validation in FIPS mode, SFTP downloads, GSSAPI authentication, compression, command-line usernames, and packet handling, as well as an sshd forwarding and tunneling authorization bypass.
Which client workflows should be reviewed most urgently?
Review systems that use X11 forwarding, SFTP downloads from untrusted servers, GSSAPI authentication, shared compression, or FIPS-mode DH-GEX connections. The advisory identifies risks including local man-in-the-middle activity, credential disclosure, file-location control, information disclosure, and denial of service in those workflows.
What server-side capability is implicated by the sshd flaw?
The server-side issue involves incorrect handling of forwarding and tunneling options in sshd, which can result in a security bypass. The advisory does not provide configuration conditions or detection steps for determining whether a particular sshd deployment is affected.