RHSA-2026:47756HighCVSS 7.7

Red Hat Security Advisory: openssh security update

Published
July 29, 2026
Last Modified
August 18, 2026

🔗 CVE IDs covered (5)

CVE-2026-55653 →CVE-2026-55654 →CVE-2026-55655 →CVE-2026-59996 →CVE-2026-60002 →

📋 Description

CVE-2026-55653 — openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service CVE-2026-55654 — openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination CVE-2026-55655 — openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions CVE-2026-59996 — openssh: OpenSSH: scp file misplacement vulnerability during remote copy CVE-2026-60002 — openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

🎯 Affected products91

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:9.9p1-9.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:9.9p1-9.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +61 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client's SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure: ``` KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1 ``` (Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment's security requirements.) Additionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections. Workaround: To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector. Workaround: To mitigate this issue, users should avoid performing `scp` operations directly between two remote destinations. Instead, consider copying files from the first remote host to a local machine, and then from the local machine to the second remote host. Alternatively, use `sftp` or `rsync` for remote file transfers, as these utilities are not affected by this specific vulnerability. Workaround: To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.

🔗 References (8)