OpenSSH CVE-2026-55654

Exploitation requires two concurrent non-default conditions: (1) GSSAPIAuthentication must be set to 'yes' in the target server's sshd_config - this is disabled by default in most OpenSSH distributions including RHEL - and (2) a functional Kerberos environment must be integrated with the SSH server, including a reachable KDC and properly configured keytab. Without both conditions, the vulnerable GSSAPI cleanup code path is never exercised. Authentication is not required (PR:N per CVSS vector), meaning any network-reachable unauthenticated party can attempt the trigger once these infrastructure conditions are met. Exploitation is limited strictly to causing a DoS (crash/abort of the auth path); code execution, data exfiltration, and integrity impact are not possible per the CVSS impact metrics (C:N/I:N). The AC:H rating further indicates that reliably triggering the crash is not straightforward even in qualifying environments.

The NVD CVSS 3.1 base score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L accurately characterizes this as a low-priority issue for most organizations. AC:H reflects the real constraint: exploitation requires a live Kerberos KDC integrated with the SSH server, which is a non-default enterprise configuration. The partial availability impact (A:L rather than A:H) suggests the crash aborts only the affected authentication session rather than taking down the entire sshd daemon. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; however, the non-trivial setup requirement and absence of KEV listing or known POC all point to low exploitation likelihood. No conflicting signals exist between the CVSS vector and the description - both consistently indicate a network-reachable but conditionally exploitable, availability-only DoS. For enterprises running RHEL with Kerberos-integrated SSH this warrants patching at normal cycle cadence; for environments without GSSAPI/Kerberos, the risk is effectively zero.

An unauthenticated attacker identifies an SSH server on a RHEL host with GSSAPIAuthentication enabled and a reachable Kerberos KDC. The attacker initiates a crafted GSSAPI authentication exchange designed to leave the auth-indicators array without a NULL terminator, causing the sshd cleanup routine to perform a heap out-of-bounds read. The resulting crash or abort of the authentication handler disrupts SSH connectivity for other users attempting to log in, constituting a targeted availability denial without any code execution or data exposure.