RHSA-2026:99573HighCVSS 7.5

Red Hat Security Advisory: openssh security update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (8)

CVE-2026-55655 →CVE-2026-59995 →CVE-2026-59999 →CVE-2026-106553 →CVE-2026-106582 →CVE-2026-106583 →CVE-2026-106585 →CVE-2026-55653 →

📋 Description

CVE-2026-55653 — openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service CVE-2026-55655 — openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions CVE-2026-59995 — openssh: OpenSSH: sftp client allows attacker to control downloaded file location CVE-2026-59999 — openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options CVE-2026-106553 — openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication CVE-2026-106582 — openssh: openssh: Information disclosure via shared compression side-channel CVE-2026-106583 — openssh: openssh: Command injection via unvalidated command-line username CVE-2026-106585 — openssh: openssh: Denial of service via oversized decompressed packets

🎯 Affected products58

  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-0:8.0p1-7.el8_4.3.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-0:8.0p1-7.el8_4.3.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-askpass-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • openssh-askpass-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • openssh-askpass-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • openssh-askpass-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • openssh-askpass-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-askpass-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-cavs-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-cavs-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-cavs-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • openssh-cavs-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • openssh-cavs-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-cavs-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-clients-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-clients-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-clients-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • openssh-clients-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • openssh-clients-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-clients-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • openssh-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • openssh-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • openssh-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • openssh-debuginfo-0:8.0p1-7.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • +28 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client's SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure: ``` KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1 ``` (Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment's security requirements.) Additionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections. Workaround: To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector. Workaround: To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root). Workaround: To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy. After modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions. Workaround: Set GSSAPIAuthentication to no in the sshd configuration (e.g. /etc/ssh/sshd_config) and reload or restart the sshd service. This flaw only occurs when GSSAPI authentication is enabled, which is not the default configuration, so deployments that do not rely on GSSAPI authentication can disable it to prevent credentials from persisting after a failed authentication attempt. The upstream fix is included in OpenSSH 10.6; for the affected Red Hat Hardened Images package, apply the update once it becomes available through the product's update stream. Workaround: Session compression is not enabled by default in OpenSSH; keeping it disabled prevents this side-channel. Set 'Compression no' in sshd_config on servers and in ssh_config (or use 'ssh -o Compression=no') on clients where compression has been enabled. Avoid multiplexing trusted and untrusted traffic over a single shared SSH connection, for example via ssh connection multiplexing (ControlMaster). Where compression of transferred data is required, applying compression at the application level before data enters the SSH session is not affected by this type of attack. A fix is being pursued for the affected Red Hat Hardened Images product. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)