RHSA-2026:99592: Important: openssh security update
Important: openssh security update
Other sources
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.Security Fix(es): openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions (CVE-2026-55655) openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) openssh: openssh: Information disclosure via shared compression side-channel (CVE-2026-106582) openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication (CVE-2026-106553) openssh: openssh: Denial of service via oversized decompressed packets (CVE-2026-106585) openssh: openssh: Command injection via unvalidated command-line username (CVE-2026-106583) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensshto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-askpassto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-askpass-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-cavsto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-cavs-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-clientsto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-clients-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-debugsourceto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-keycatto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-keycat-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-ldapto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-serverto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6 - Upgrade
Upgrade
redhat/openssh-server-debuginfoto a version that resolves this vulnerability.Fixed in 8.0p1-15.el8_6.6
Event History
Frequently Asked Questions
Do systems that only use OpenSSH as a client need this update?
Yes. The listed fixes include client-side issues affecting X11 forwarding, the DH-GEX path during FIPS known-group validation, SFTP download locations, failed GSSAPI authentication, and command-line usernames. Client-only systems may therefore be exposed depending on which of those features they use.
Which server-side SSH functions are implicated?
The update includes an sshd security bypass involving forwarding and tunneling options. It also addresses denial of service through oversized decompressed packets, which may affect SSH services processing such packets.
Are X11 forwarding and FIPS-related SSH use cases specifically relevant?
Yes. One issue is a local man-in-the-middle condition for X11 forwarding through abstract UNIX socket pre-binding in the Red Hat Enterprise Linux OpenSSH client. Another is a client-side denial of service in the DH-GEX path when FIPS known-group validation is performed.