Skip to main content

OpenSSH CVE-2026-60000

| EUVDEUVD-2026-42143 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-08 mitre GHSA-76jm-35gr-hwcm
High
Disputed · 7.5 NVD
Share

Severity by source

Sources disagree (Low–High)
Vendor (mitre) PRIMARY
LOW
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Requires the non-default GSSAPIAuthentication feature enabled (AC:H); unauthenticated network reachable (PR:N/AV:N); partial resource-consumption DoS per SSVC so availability-only and A:L, no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.9 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 09, 2026 - 16:58 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 09, 2026 - 16:57 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 09, 2026 - 16:52 vuln.today
cvss_changed
Severity Changed
Jul 09, 2026 - 16:52 NVD
LOW HIGH
CVSS changed
Jul 09, 2026 - 16:52 NVD
3.7 (LOW) 7.5 (HIGH)
Patch available
Jul 08, 2026 - 02:01 EUVD
Analysis Generated
Jul 08, 2026 - 01:24 vuln.today

DescriptionNVD

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

AnalysisAI

Denial of service in OpenSSH sshd before 10.4 lets remote unauthenticated attackers exhaust server resources by driving excessive authentication attempts, because the MaxAuthTries cap was not correctly enforced for the GSSAPIAuthentication path. Only deployments that have enabled GSSAPI-based authentication are exposed, and there is no public exploit identified at time of analysis. EPSS is low (0.34%, 26th percentile) and CISA SSVC records no observed exploitation, so this is a real but non-urgent availability issue rather than a code-execution threat.

Technical ContextAI

The affected component is sshd, the OpenSSH server daemon (cpe:2.3:a:openbsd:openssh). OpenSSH normally bounds the number of failed authentication attempts per connection via the MaxAuthTries directive, forcing a disconnect once the limit is reached. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) issue: in the GSSAPIAuthentication code path the MaxAuthTries counter was mishandled, so an attacker could keep submitting authentication attempts beyond the intended ceiling. Each attempt consumes CPU, memory and connection-handling resources, and GSSAPI/Kerberos negotiation is comparatively expensive, so repeated attempts can degrade or exhaust server capacity. GSSAPIAuthentication is disabled by default in stock OpenSSH and is typically enabled only in Kerberos/Active Directory integrated environments.

RemediationAI

Vendor-released patch: OpenSSH 10.4 (portable 10.4p1) - upgrade sshd to 10.4/10.4p1 or later, or apply the fixed package from your distribution once it incorporates the upstream release (https://www.openssh.org/releasenotes.html#10.4p1). Where immediate patching is not possible, the most direct compensating control is to disable the vulnerable feature by setting 'GSSAPIAuthentication no' in sshd_config and restarting sshd; the trade-off is that Kerberos/GSSAPI single sign-on will stop working, so this is only safe in environments that do not rely on it. Additionally, restrict network reachability of TCP/22 to trusted management networks or via firewall/VPN to limit who can initiate authentication floods, and apply rate-limiting/connection throttling at the network edge (e.g. per-source connection limits) to blunt resource-exhaustion attempts; these do not fix the underlying counter mishandling but reduce exposure. Consult the oss-security announcement at https://www.openwall.com/lists/oss-security/2026/07/06/5 for details.

More in SSH

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2014-6278 HIGH POC
8.8 Sep 30

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2012-6066 CRITICAL POC
9.3 Dec 04

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons

CVE-2014-6277 CRITICAL POC
10.0 Sep 27

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se

CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin

CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2012-5975 CRITICAL POC
9.3 Dec 04

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6

CVE-2025-26465 MEDIUM
6.8 Feb 18

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-60000 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy