CVE-2026-3497 @ Janus

"CVE-2026-3497"
"openssh-client-7.9p1-10+deb10u4"
"openssh-server-7.9p1-10+deb10u4"
"openssh-sftp-server-7.9p1-10+deb10u4)"
"openssh"
"openssh-client-1:7.9p1-10+deb10u4"
"openssh-server-1:7.9p1-10+deb10u4"
"openssh-sftp-server-1:7.9p1-10+deb10u4"
"Am I vulnerable?"

Status

new

Priority

0.48

Match score

3.0

Risk

DoS Remote

CVSS

7.5 HIGH

Reason

cpe: openssh; pkgs: openssh-client, openssh-server, openssh-sftp-server; version: unknown (openssh-client-7.9p1-10+deb10u4; openssh-server-7.9p1-10+deb10u4; openssh-sftp-server-7.9p1-10+deb10u4); risk:dos

Created

2026-10-15T10:19:44Z

Updated

2026-10-20T10:18:11Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
openssh-client-7.9p1-10+deb10u4
openssh-server-7.9p1-10+deb10u4
openssh-sftp-server-7.9p1-10+deb10u4)
openssh
openssh-client-1:7.9p1-10+deb10u4
openssh-server-1:7.9p1-10+deb10u4
openssh-sftp-server-1:7.9p1-10+deb10u4

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: openssh-client · openssh-server · openssh-sftp-server · openssh

System	Matches	Ticket for CVE-2026-3497
Archive	openssh-sftp-server 1:7.9p1-10+deb10u4	new open
Janus	openssh-sftp-server 1:7.9p1-10+deb10u4	new open
Library	openssh-sftp-server 1:7.4p1-10+deb9u7	new open
Saiph	openssh-sftp-server 1:7.9p1-10+deb10u4	new open
Bullseye	openssh-sftp-server 1:8.4p1-5+deb11u7	none
Helios	openssh-sftp-server 1:8.4p1-5+deb11u7	none
Matrix	openssh-sftp-server 1:9.2p1-2+deb12u10	none
Silk	openssh-sftp-server 1:9.2p1-2+deb12u10	none

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2023-38408	9.8	Archive, Janus, Library, Saiph, morris …	new	openssh-client	—
CVE-2020-15778	7.4	Archive, Janus, Library, Saiph, morris …	new	openssh-client	—
CVE-2023-51767	7.0	Archive, Bullseye, Helios, Janus, Library …	new	openssh-client	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	new	6.06	2026-10-20T10:18:11Z	Open
mufasa	new	6.06	2026-10-20T10:18:11Z	Open
Library	new	1.47	2026-10-20T10:18:11Z	Open
Saiph	new	0.48	2026-10-20T10:18:11Z	Open
Archive	new	0.48	2026-10-20T10:18:10Z	Open

Description

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

Update status

Add note only

References

NVD: CVE-2026-3497