RLSA-2026:97866: Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997)
openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998)
openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/opensshto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-askpassto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-askpass-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-clientsto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-clients-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-debugsourceto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keycatto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keycat-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-serverto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/pam_ssh_agent_authto a version that resolves this vulnerability.Fixed in 0:0.10.4-10.16.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/pam_ssh_agent_auth-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.10.4-10.16.el9_9.rocky.0.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux packages are covered by this update?
The advisory lists openssh, openssh-clients, openssh-askpass, openssh-keycat, and their associated debuginfo or debugsource packages. The OpenSSH package set includes components for both SSH clients and servers.
What does the published severity vector indicate about exploitation?
The published CVSS vector indicates network attack access, low attack complexity, no required privileges, and no user interaction. It indicates low confidentiality and integrity impact, with no availability impact in that vector.
Which security issues are included in the update?
The update addresses an SFTP command-line argument parsing bypass, GSSAPIStrictAcceptorCheck behavior affecting Windows Active Directory, and denial of service through excessive GSSAPI authentication attempts. The listed CVEs are CVE-2026-59997, CVE-2026-59998, and CVE-2026-60000.