OpenSSH GSSAPI Key Exchange Flaw Exposes Systems to DoS and Information Disclosure
A flaw in OpenSSH's GSSAPI key exchange handling was disclosed on the oss-security mailing list and later tracked as CVE-2026-3497, with Red Hat describing the issue as an information disclosure or denial-of-service condition caused by uninitialized variables. The bug affects OpenSSH deployments that use GSSAPI authentication or key exchange, where improper handling of internal state can allow an attacker to trigger crashes or expose unintended memory contents under certain conditions.
Vendor tracking shows the issue moved from public disclosure into downstream remediation, with Red Hat opening Bugzilla case 2447085 for affected products. Separate references to Oracle Linux and a SonicWall advisory indicate vendors were also assessing or mapping related OpenSSH exposure in their own ecosystems, underscoring that the impact extends beyond a single distribution and requires organizations using GSSAPI-enabled SSH services to review patches and product advisories promptly.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat Bugzilla entry created for CVE-2026-3497 in OpenSSH
Red Hat published Bugzilla entry 2447085 for CVE-2026-3497, describing an OpenSSH GSSAPI vulnerability involving uninitialized variables that could lead to information disclosure or denial of service.
OpenSSH GSSAPI key exchange patch issue disclosed on oss-security
An oss-security post disclosed an issue with an OpenSSH GSSAPI key exchange patch, publicly surfacing technical details about the flaw or patch problem.
SonicWall publishes security advisory SNWLID-2024-0010
SonicWall published security advisory SNWLID-2024-0010, marking a vendor disclosure or tracking event for the affected issue.
Oracle Linux issue opened for OL9 and CVE-2024-6387
A GitHub issue was published in the oracle-linux repository referencing Oracle Linux 9 and CVE-2024-6387, indicating vendor tracking or discussion of the vulnerability for that platform.
Sources
4 references tracked. Mallory keeps watching after this page renders.
2447085 - (CVE-2026-3497) CVE-2026-3497 openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables
bugzilla.redhat.com
Open sourceoss-security - OpenSSH GSSAPI keyex patch issue
openwall.com
Open sourceSecurity Advisory
psirt.global.sonicwall.com
Open sourceOL9 and CVE-2024-6387 · Issue #149 · oracle/oracle-linux
github.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
regreSSHion OpenSSH Flaw Exposes sshd to Unauthenticated Remote Code Execution
A high-severity vulnerability tracked as **CVE-2024-6387** has been disclosed in **OpenSSH `sshd`**, where a race condition in signal handling can let a remote, unauthenticated attacker trigger **remote code execution** or cause a **denial of service** by precisely timing a timeout during authentication. The bug, widely referred to as **regreSSHion**, affects OpenSSH versions **8.5p1 through 9.7p1** and revives a class of weakness in one of the most widely deployed remote administration services on Linux and Unix-like systems. Reports said the exposure could affect roughly **700,000 Linux systems**, underscoring the internet-facing risk for organizations that rely on SSH for remote access. **OpenSSH 9.8 and later** include a fix, and vendors including **Red Hat** have issued advisories for impacted deployments, prompting defenders to identify exposed `sshd` instances, prioritize patching, and review compensating controls for externally reachable SSH services.
Jun 29, 2026
Critical OpenShift and OpenSSH Flaws Expose Linux Systems to Root Access
Authorities warned that **Red Hat OpenShift Container Platform 4** contains two high-severity vulnerabilities that can lead to code execution and node takeover in enterprise container environments. `CVE-2024-45496` in `ose-openshift-controller-manager-container` carries a **CVSS 9.9** rating and can allow arbitrary code execution on an OpenShift node when a user with developer-level access exploits insufficient restrictions on elevated privileges. `CVE-2024-7387` in `openshift4/ose-docker-builder`, rated **CVSS 9.1**, can enable arbitrary command execution on an OpenShift node and may allow privilege escalation and full control of the affected node. At the time of the alert, mitigations were available but vendor patches had not yet been released. A separate alert highlighted the **regreSSHion** flaw in **OpenSSH**, which can give an attacker unrestricted root-level access on vulnerable Linux and FreeBSD-based systems. The issue affects OpenSSH versions from `8.5p1` up to but not including `9.8p1`, as well as versions earlier than `4.4p1`; OpenBSD-based systems were reported as not vulnerable. Successful exploitation has been confirmed on systems using **glibc**, while systems using **musl libc** were reported as not vulnerable, and the attack currently requires repeated attempts over hours or days. A fix is available in **OpenSSH `9.8p1`**, though some distributors have backported the patch, meaning package version numbers alone may not reliably indicate exposure.
Jun 29, 2026
Critical libssh2 Flaws Expose SSH Clients to RCE, DoS, and Memory Disclosure
Multiple vulnerabilities in **libssh2** have exposed SSH clients and products that embed the library to attacks from malicious or impersonated SSH servers. The most severe issue, **`CVE-2026-55200`**, is a pre-authentication out-of-bounds heap write in `ssh2_transport_read()` that affects all versions through **1.11.1** and could allow remote code execution, while **`CVE-2026-55199`** can force clients into a CPU-intensive loop during key exchange and cause denial of service. The library is widely used in **curl**, backup software, IoT firmware, and network appliances, raising broad supply-chain risk, especially where libssh2 is statically linked or bundled into downstream products. A separate flaw, **`CVE-2025-15661`**, affects `sftp_symlink()` in `src/sftp.c` and can be triggered during SFTP `READLINK` or `REALPATH` operations when a malicious server or man-in-the-middle sends a crafted `SSH_FXP_NAME` response with an oversized `link_len` value. That bug causes a heap buffer over-read that may disclose memory contents or crash applications. Fixes were reported in commits **`97acf3d`**, **`1762685`**, and **`2dae302`**, but at the time of reporting no official libssh2 release containing the newer patches had been published, leaving downstream vendors responsible for shipping their own updates.
Jul 1, 2026