Skip to main content

OpenSSH CVE-2026-73282

| EUVDEUVD-2026-56891 MEDIUM
Use After Free (CWE-416)
2026-08-11 cve@mitre.org GHSA-jwc3-6qvm-4r66
4.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
4.8 MEDIUM

Race condition between concurrent forwarding operations requires precise timing (AC:H); malicious server needs no prior authentication from the client; only partial heap-exposure impact with no availability loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.6 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat
5.6 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Aug 11, 2026 - 23:24 vuln.today
Patch available
Aug 11, 2026 - 20:34 EUVD
CVE Published
Aug 11, 2026 - 20:18 cve.org
MEDIUM 4.8

DescriptionCVE.org

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

AnalysisAI

Use-after-free (CWE-416) in OpenSSH's ssh client component affects all releases before version 10.5, triggered when a specific pair of remote-forwarding operations occur concurrently, causing access to freed realloc'd memory. A malicious or compromised SSH server could exploit this race condition against a connecting client to achieve partial information disclosure or limited memory corruption. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Client connects to attacker-controlled SSH server
Delivery
Server negotiates remote port forwarding
Exploit
Attacker triggers concurrent second forwarding request
Execution
Race condition causes use-after-free on realloc'd client buffer
Impact
Partial heap data disclosed or client memory state corrupted

Vulnerability AssessmentAI

Exploitation Exploitation requires the ssh client to perform remote port forwarding (via the -R flag or RemoteForward configuration directive) to an attacker-controlled or compromised SSH server, and two such forwarding operations must occur concurrently to trigger the race condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.8 Medium score (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects this vulnerability's constrained risk profile: network-reachable but requiring a high-complexity race condition to reliably trigger, with only partial confidentiality and integrity impact and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker operates a malicious SSH server and induces a connecting client running a vulnerable OpenSSH version to establish remote port forwards. By timing two concurrent remote-forwarding operations to race within the client, the attacker triggers the use-after-free on realloc'd memory, potentially reading fragments of the client process's heap to recover sensitive data such as session credentials or private key material. …
Remediation Upgrade to OpenSSH 10.5 or later, which resolves this use-after-free as confirmed by the project's release notes at https://www.openssh.org/releasenotes.html#10.5. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in SSH

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2014-6278 HIGH POC
8.8 Sep 30

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2012-6066 CRITICAL POC
9.3 Dec 04

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons

CVE-2014-6277 CRITICAL POC
10.0 Sep 27

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se

CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin

CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2012-5975 CRITICAL POC
9.3 Dec 04

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6

CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-73282 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy