https://seclists.org/oss-sec/2026/q4/541: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
OpenBSD OpenSSH
musl musl libc
No. The discussion explicitly says this is unclear and notes that Debian's documented crypt(3) error behavior changed from returning NULL to writing an invalid hash beginning with '*'.
No. The cited specification describes a two-character salt limited to [a-zA-Z0-9./] and says invalid salt input results in EINVAL; the discussion states that '$' is outside that scope.
It says crypt_r, crypt_rn, and crypt_ra write an invalid hash shorter than 13 characters beginning with '*', while crypt writes such a value to static storage. It further states that this value will not compare equal to the setting.