EUVD-2026-94011
GHSA-9hq3-hc6p-gc8q
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Local ssh-keygen use (AV:L) only fails around DST transitions (AC:H) and requires a user to run key generation (UI:R), yielding limited integrity impact on cert expiry with no C or A effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
AnalysisAI
ssh-keygen in OpenSSH versions before 10.6 can assign incorrect expiration timestamps to generated certificates when a Daylight Saving Time transition is mishandled, producing a bounded integrity error in the certificate's validity window. The issue is local: it requires a user to run ssh-keygen for certificate creation or signing, and it only manifests around DST changes, with slightly more pronounced effects noted for certain Antarctic time zones. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local use of the ssh-keygen tool to generate or sign a certificate, and the miscalculation only manifests around a Daylight Saving Time transition - so the triggering window is narrow and timing-dependent (reflected in AC:H and UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine low-priority issue, not a high-CVSS-but-low-real-risk case - the signals are internally consistent at the low end. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenSSH 10.6 or later; this is the vendor-released patch and the definitive fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today