CVE-2026-3497

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpktdisconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use sshpacket_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

Database specific

{
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-908"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1:10.0p1-5ubuntu5"
                },
                {
                    "fixed": "1:10.0p1-5ubuntu5.1"
                },
                {
                    "introduced": "1:9.6p1-3ubuntu13"
                },
                {
                    "fixed": "1:9.6p1-3ubuntu13.15"
                },
                {
                    "introduced": "1:8.9p1-3"
                },
                {
                    "fixed": "1:8.9p1-3ubuntu0.14"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3497.json"
}

References

Affected packages

Git / github.com/openssh/openssh-portable

Affected ranges

Type

GIT

Repo

https://github.com/openssh/openssh-portable

Events

Introduced

fd0fa130ecf06d7d092932adcd5d77f1549bfc8d

Last affected

94eb6858efecc1b4f02d8a6bd35e149f55c814c8

Database specific

{
    "extracted_events": [
        {
            "introduced": "8.0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "9.0"
        },
        {
            "last_affected": "9.0"
        }
    ],
    "cpe": [
        "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING"
}

Affected versions

8.*

8.0

9.*

9.0

Other

V_8_0_P1

V_8_1_P1

V_8_2_P1

V_8_4_P1

V_8_5_P1

V_8_6_P1

V_8_7_P1

V_8_8_P1

V_8_9_P1

V_9_0_P1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3497.json"