medium CVSS 4.8

CVE-2026-73282·OpenSSH vulnerability

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

Severity
medium
Software
OpenSSH
Fixed in
10.5
Published

Affected versions

Until: 10.5

Fixed in: 10.5

How to fix this CVE

Update OpenSSH to version 10.5 or later to resolve a memory safety issue affecting concurrent remote port forwarding operations. This vulnerability can lead to information disclosure or service disruption if multiple forwarding channels are established simultaneously. Apply the update at your earliest convenience, especially on systems handling sensitive SSH traffic.

sudo dnf update openssh-server openssh openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'ssh -V' or 'sshd -V' to check the installed OpenSSH version on your system
  2. Verify if SSH is exposed to remote networks by checking firewall rules with 'sudo iptables -L -n | grep 22' or 'sudo firewall-cmd --list-all'
  3. Search SSH daemon logs for concurrent port forwarding requests: 'grep -i "remote forward\|port forward" /var/log/auth.log /var/log/secure'
  4. After updating, confirm the new version with 'ssh -V' and verify sshd is running: 'sudo systemctl status ssh' or 'sudo systemctl status sshd'

FAQ

What is CVE-2026-73282?

CVE-2026-73282 is a use-after-free memory vulnerability in OpenSSH that occurs when certain remote port forwarding operations are executed concurrently, potentially allowing attackers to read sensitive memory or crash the SSH daemon.

Is CVE-2026-73282 being actively exploited?

No, CVE-2026-73282 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available.

What versions of OpenSSH are affected by CVE-2026-73282?

All OpenSSH versions prior to 10.5 are affected by this vulnerability.

How do I check if my server is vulnerable to CVE-2026-73282?

Run 'ssh -V' to display your OpenSSH version; if it reports a version earlier than 10.5, your system is vulnerable and requires an immediate update.

Does Defensia detect CVE-2026-73282?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2026-73282 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-73282. Free for 1 server.

Get started free