CVE-2026-55654— Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenSSH OpenSSH是OpenSSH组织的一个安全管理连接的软件。 OpenSSH存在缓冲区错误漏洞，该漏洞源于清理GSSAPI指示器时缺少尾部NULL终止符导致的堆越界读取，可能导致远程攻击者在特定配置下使SSH认证路径崩溃或中止，导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion FloodAffected Version Matrix 13
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:9.9p1-25.el10_2< * |
unaffected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | 0:9.9p1-9.el9_8< * |
unaffected |
0:9.9p1-9.el9_8< * |
unaffected | ||
| Red Hat | Red Hat Hardened Images | 10.3p1-6.hum1< * |
unaffected |
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Update Infrastructure 5 | 1786435483< * |
unaffected |
1786533529< * |
unaffected | ||
1787135742< * |
unaffected | ||
1787241260< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSSH 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSSH OpenSSH是OpenSSH组织的一个安全管理连接的软件。 OpenSSH存在缓冲区错误漏洞，该漏洞源于清理GSSAPI指示器时缺少尾部NULL终止符导致的堆越界读取，可能导致远程攻击者在特定配置下使SSH认证路径崩溃或中止，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:9.9p1-25.el10_2 ~ * |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:9.9p1-9.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:9.9p1-9.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Hardened Images | 10.3p1-6.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Update Infrastructure 5 | 1786435483 ~ * |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | 1786533529 ~ * |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | 1787135742 ~ * |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | 1787241260 ~ * |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-55654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55654
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55654 (7)
-
-
-
🔗 RHSA-2026:36759 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:47756 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:47757 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-06-23 · 12 CVEs total
| CVE-2026-11807 | 9.6 CRITICAL | Eda-server: websocket missing authorization allows credential theft via activation_id spoo |
| CVE-2026-12112 | 7.8 HIGH | Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse |
| CVE-2026-10609 | 6.8 MEDIUM | Openshift/cluster-logging-operator: cluster logging operator creates and forwards servicea |
| CVE-2026-11820 | 6.5 MEDIUM | Community.general: community.general nexmo — api credentials exposed in get url query stri |
| CVE-2026-9073 | 6.2 MEDIUM | Foreman-mcp-server: mcp server: insecure sensitive http header sanitization |
| CVE-2026-11819 | 5.5 MEDIUM | Community.general: community.general keyring_info — os keyring passphrase returned in plai |
| CVE-2026-12969 | 5.3 MEDIUM | Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation |
| CVE-2026-55655 | 5.0 MEDIUM | Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat ente |
| CVE-2026-12892 | 4.4 MEDIUM | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.2 |
| CVE-2026-55653 | 4.3 MEDIUM | Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path du |
| CVE-2026-12891 | 4.3 MEDIUM | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme -
CVE-2026-107565
Luksmeta: incomplete gap-boundary and overlap checks in luks -
CVE-2026-107466
Flatpak-builder: local file exfiltration via `file
Same vendor: Red Hat
-
CVE-2026-108119
Busybox: busybox: tar extraction-root escape via deferred sy -
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme
Same weakness: CWE-125
-
CVE-2026-107837
RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Han -
CVE-2026-107836
RIOT: nanoCoAP Block2 client slice handling underflows on in -
CVE-2026-107817
MariaDB: mysql_json plugin OOB reads -
CVE-2026-107816
MariaDB: `qc_info` plugin can do OOB reads if query contains -
CVE-2026-108103
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropp
V. Comments for CVE-2026-55654
No comments yet