CVE-2026-3497 @ Archive
Status
new
Priority
0.48
Match score
3.0
Risk
DoS
Remote
CVSS
7.5 HIGH
Reason
cpe: openssh; pkgs: openssh-client, openssh-server, openssh-sftp-server; version: unknown (openssh-client-7.9p1-10+deb10u4; openssh-server-7.9p1-10+deb10u4; openssh-sftp-server-7.9p1-10+deb10u4); risk:dos
Created
2026-10-15T10:19:44Z
Updated
2026-10-20T10:18:10Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| openssh-client-7.9p1-10+deb10u4 | |
| openssh-server-7.9p1-10+deb10u4 | |
| openssh-sftp-server-7.9p1-10+deb10u4) | |
| openssh | |
| openssh-client-1:7.9p1-10+deb10u4 | |
| openssh-server-1:7.9p1-10+deb10u4 | |
| openssh-sftp-server-1:7.9p1-10+deb10u4 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: openssh-client · openssh-server · openssh-sftp-server · openssh
| System | Matches | Ticket for CVE-2026-3497 | |
|---|---|---|---|
| Archive | openssh-client 1:7.9p1-10+deb10u4; openssh-server 1:7.9p1-10+deb10u4; openssh-sftp-server 1:7.9p1-10+deb10u4 | new open | |
| Janus | openssh-client 1:7.9p1-10+deb10u4; openssh-server 1:7.9p1-10+deb10u4; openssh-sftp-server 1:7.9p1-10+deb10u4 | new open | |
| Library | openssh-client 1:7.4p1-10+deb9u7; openssh-server 1:7.4p1-10+deb9u7; openssh-sftp-server 1:7.4p1-10+deb9u7 | new open | |
| Saiph | openssh-client 1:7.9p1-10+deb10u4; openssh-server 1:7.9p1-10+deb10u4; openssh-sftp-server 1:7.9p1-10+deb10u4 | new open | |
| morris | cpanel-perl-536-net-openssh 0.82; openssh 7.4p1; openssh-clients 7.4p1; openssh-server 7.4p1 | new open | |
| mufasa | cpanel-perl-536-net-openssh 0.82; openssh 7.4p1; openssh-clients 7.4p1; openssh-server 7.4p1 | new open | |
| Bullseye | openssh-client 1:8.4p1-5+deb11u7; openssh-server 1:8.4p1-5+deb11u7; openssh-sftp-server 1:8.4p1-5+deb11u7 | none | |
| Helios | openssh-client 1:8.4p1-5+deb11u7; openssh-server 1:8.4p1-5+deb11u7; openssh-sftp-server 1:8.4p1-5+deb11u7 | none | |
| Matrix | openssh-client 1:9.2p1-2+deb12u10; openssh-server 1:9.2p1-2+deb12u10; openssh-sftp-server 1:9.2p1-2+deb12u10 | none | |
| Silk | openssh-client 1:9.2p1-2+deb12u10; openssh-server 1:9.2p1-2+deb12u10; openssh-sftp-server 1:9.2p1-2+deb12u10 | none |
Same product CVEs in your queue
Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2023-38408 | 9.8 | Archive, Janus, Library, Saiph, morris … | new | openssh-client | — | ||
| CVE-2020-15778 | 7.4 | Archive, Janus, Library, Saiph, morris … | new | openssh-client | — | ||
| CVE-2023-51767 | 7.0 | Archive, Bullseye, Helios, Janus, Library … | new | openssh-client | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
Debian GNU/Linux 10 (buster)
(10)
· debian
Arch
x86_64
kernel_release
uname -r → 5.10.0-25-amd64kernel_version
uname -v → #1 SMP Debian 5.10.191-1 (2023-08-16)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 6.06 | 2026-10-20T10:18:11Z | Open |
| mufasa | new | 6.06 | 2026-10-20T10:18:11Z | Open |
| Library | new | 1.47 | 2026-10-20T10:18:11Z | Open |
| Janus | new | 0.48 | 2026-10-20T10:18:11Z | Open |
| Saiph | new | 0.48 | 2026-10-20T10:18:11Z | Open |
Description
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
Update status
Add note only
References
- https://ubuntu.com/security/CVE-2026-3497
- https://www.openwall.com/lists/oss-security/2026/03/12/3
- http://www.openwall.com/lists/oss-security/2026/03/12/3
- http://www.openwall.com/lists/oss-security/2026/03/14/3
- http://www.openwall.com/lists/oss-security/2026/03/14/4
- http://www.openwall.com/lists/oss-security/2026/03/18/2
- http://www.openwall.com/lists/oss-security/2026/03/18/4
- http://www.openwall.com/lists/oss-security/2026/03/18/5
- http://www.openwall.com/lists/oss-security/2026/03/18/7
- https://lists.debian.org/debian-lts-announce/2026/04/msg00014.html
- https://access.redhat.com/errata/RHSA-2026:10065
- https://access.redhat.com/errata/RHSA-2026:10714
- https://access.redhat.com/errata/RHSA-2026:12071
- https://access.redhat.com/errata/RHSA-2026:13750
- https://access.redhat.com/errata/RHSA-2026:13812
NVD: CVE-2026-3497