https://seclists.org/oss-sec/2026/q4/555: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH
musl musl libc
The discussion identifies failure to check for a NULL pointer as the relevant condition. It states that applications which do not check for NULL are affected by this behavior.
The discussion says an OpenSSH change was made around 2019. It also says that, before that change, Debian documented NULL as an error return in a different manpage.