CVE-2026-35387

Description

References

• marc.info · Third Party Advisory
• openssh.org/releasenotes.html · Release Notes
• openwall.com/lists/oss-security/2026/04/02/3 · Third Party Advisory

Weitere Schwachstellen in openssh

• CVE-2026-106583HOCH 7.8In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
• CVE-2026-106587NIEDRIG 3.3In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean …
• CVE-2026-106586MITTEL 4.3In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a …
• CVE-2026-106585MITTEL 6.5In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c…
• CVE-2026-106584NIEDRIG 3.3In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can b…