CVE-2026-3497Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.
Updated under an hour ago ()
Does this affect you?
It affects Ubuntu openssh and 21 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
- CVSS
- 2.7 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-908, CWE-824
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- canonical
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Ubuntu openssh ubuntu:openssh (from the name) | from 1:10.0p1-5ubuntu5 before 1:10.0p1-5ubuntu5.1; from 1:9.6p1-3ubuntu13 before 1:9.6p1-3ubuntu13.15; from 1:8.9p1-3 before 1:8.9p1-3ubuntu0.14 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:9.9p1-13.el10_1 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:9.9p1-7.el10_0.2 not affected | CISA ADP |
from 0:8.0p1-7.el8_4.1 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On redhat:rhel_eus_long_life | from 0:8.0p1-7.el8_4.1 not affected | CISA ADP |
from 0:8.0p1-15.el8_6.4 not affected | CISA ADP | |
from 0:8.0p1-15.el8_6.4 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support redhat:rhel_eus | from 0:8.7p1-38.el9_4.7 not affected | CISA ADP |
Red Hat Red Hat OpenShift Container Platform 4.12 redhat:openshift | from 412.86.202605271418-0 not affected | CISA ADP |
Red Hat RHEL-8 based Middleware Containers redhat:rhosemc | from 7.13.5-4.1777325677 not affected | CISA ADP |
Red Hat Red Hat AI Inference Server 3.2 redhat:ai_inference_server | from 1779223654 not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 10.2p1-9.hum1 not affected | CISA ADP |
Red Hat Red Hat Update Infrastructure 5 redhat:rhui | from 1776868772 not affected | CISA ADP |
Red Hat Multicluster Engine for Kubernetes redhat:multicluster_engine | Versions not stated | CISA ADP |
Red Hat OpenShift Pipelines redhat:openshift_pipelines | 1 | CISA ADP |
2 | CISA ADP | |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
canonical ubuntu_linux canonical:ubuntu_linux | 25.10; 20.04; 22.04; 24.04 | NVD |
openbsd openssh openbsd:openssh | all versions | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0; 9.0; 10.0 | NVD |
References
- https://ubuntu.com/security/CVE-2026-3497vdb-entry, third-party-advisory
- https://www.openwall.com/lists/oss-security/2026/03/12/3mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/12/3mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/14/3mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/14/4mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/18/2mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/18/4mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/18/5mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/03/18/7mailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2026/04/msg00014.htmlmailing-list, third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:10065
- https://access.redhat.com/errata/RHSA-2026:10714
- https://access.redhat.com/errata/RHSA-2026:12071
- https://access.redhat.com/errata/RHSA-2026:13750
- https://access.redhat.com/errata/RHSA-2026:13812
- https://access.redhat.com/errata/RHSA-2026:14773
- https://access.redhat.com/errata/RHSA-2026:14924
- https://access.redhat.com/errata/RHSA-2026:15087
- https://access.redhat.com/errata/RHSA-2026:15891
- https://access.redhat.com/errata/RHSA-2026:15893
- https://access.redhat.com/errata/RHSA-2026:16008
- https://access.redhat.com/errata/RHSA-2026:16009
- https://access.redhat.com/errata/RHSA-2026:16030
- https://access.redhat.com/errata/RHSA-2026:16174
- https://access.redhat.com/errata/RHSA-2026:17596
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.