https://seclists.org/oss-sec/2026/q4/573: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 7, 2026
·Updated
Affected Software
2 affected components
OpenBSD OpenSSH
musl musl libc
The reported failure occurs with a 257-character candidate password; a 256-character candidate reportedly works.
The supplied measurements report locked-password checks taking about 0.06 microseconds, compared with 34.84 milliseconds for a live yescrypt check. This difference could allow an observer to distinguish locked entries from accounts requiring a live password verification.
No. On a system described as having no valid password hashes, a nonexistent user reportedly fell within the locked-account timing range, at 1.7 milliseconds across six tested classes.