https://seclists.org/oss-sec/2026/q4/554: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH
musl musl libc
Applications that call crypt(3) and do not check whether it returned a NULL pointer on error may be affected by the changed API behavior discussed in the report. The report raises concern that this could cause security issues in other software, but does not identify specific additional products.
No. The report says the OpenSSH workaround is important, but explicitly questions whether it is sufficient to address all consequences of the behavior.
Review software that uses crypt(3), particularly password-authentication code, to determine whether it handles NULL error returns. The cited crypt(3) documentation states that a successful call returns a pointer to the hashed password and an error returns NULL.