openssh: Fix of CVE-2026-106587
- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile, TrustedUserCAKeys and Banner when a Match block set them to "none", so the global value stayed in effect before authentication; clear them in the pre-auth part of copy_set_server_options(). Backport upstream commit 526fd277. - CVE-2026-106586: sshd dropped the authorized_keys "restrict" flag when merging key and certificate options, which could re-enable features such as tunnel forwarding; OR the restricted flag in sshauthopt_merge(). Backport upstream commit 991f1f31. - CVE-2026-106552: sftp(1) accepted an empty file name from a server directory listing and could pick ".." or the local root as an implicit download destination; reject empty names and map ".." and remote roots to ".". Backport upstream commit c07ea218. - CVE-2026-106584: ssh-keygen(1) converted certificate validity dates without letting mktime() decide DST, giving expiry times off by an hour; set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit aef20dfe. - CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary coder, exposing a compression side channel; use Huffman-only compression for outgoing packets. Backport upstream commit 1d5340fc.
- Products
- openssh, openssh-askpass, openssh-clients, openssh-keycat, openssh-server, openssh-sk-dummy, pam_ssh_agent_auth
- Affected versions
- Not specified
- Fixed versions
- 0.10.4-5.30.el9_2.tuxcare.els25, 8.7p1-30.el9_2.tuxcare.els25
- CVEs
- CVE-2026-106552, CVE-2026-106582, CVE-2026-106584, CVE-2026-106586, CVE-2026-106587
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:57 UTC · Revision 1
Source evidence
- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile, TrustedUserCAKeys and Banner when a Match block set them to "none", so the global value stayed in effect before authentication; clear them in the pre-auth part of copy_set_server_options(). Backport upstream commit 526fd277. - CVE-2026-106586: sshd dropped the authorized_keys "restrict" flag when merging key and certificate options, which could re-enable features such as tunnel forwarding; OR the restricted flag in sshauthopt_merge(). Backport upstream commit 991f1f31. - CVE-2026-106552: sftp(1) accepted an empty file name from a server directory listing and could pick ".." or the local root as an implicit download destination; reject empty names and map ".." and remote roots to ".". Backport upstream commit c07ea218. - CVE-2026-106584: ssh-keygen(1) converted certificate validity dates without letting mktime() decide DST, giving expiry times off by an hour; set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit aef20dfe. - CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary coder, exposing a compression side channel; use Huffman-only compression for outgoing packets. Backport upstream commit 1d5340fc.
osv:CLSA-2026-1792513900
openssh
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
openssh-askpass
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
openssh-clients
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
openssh-keycat
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
openssh-server
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
openssh-sk-dummy
Fixed versions: 8.7p1-30.el9_2.tuxcare.els25
pam_ssh_agent_auth
Fixed versions: 0.10.4-5.30.el9_2.tuxcare.els25
Complete source record
{
"id": "8319a04ab662134a67bd35e20703d1b8ee2f8a7b2284f3b9afea61275cae1427",
"url": "https://osv.dev/vulnerability/CLSA-2026-1792513900",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "openssh: Fix of CVE-2026-106587",
"summary": "- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile, TrustedUserCAKeys and Banner when a Match block set them to \"none\", so the global value stayed in effect before authentication; clear them in the pre-auth part of copy_set_server_options(). Backport upstream commit 526fd277. - CVE-2026-106586: sshd dropped the authorized_keys \"restrict\" flag when merging key and certificate options, which could re-enable features such as tunnel forwarding; OR the restricted flag in sshauthopt_merge(). Backport upstream commit 991f1f31. - CVE-2026-106552: sftp(1) accepted an empty file name from a server directory listing and could pick \"..\" or the local root as an implicit download destination; reject empty names and map \"..\" and remote roots to \".\". Backport upstream commit c07ea218. - CVE-2026-106584: ssh-keygen(1) converted certificate validity dates without letting mktime() decide DST, giving expiry times off by an hour; set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit aef20dfe. - CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary coder, exposing a compression side channel; use Huffman-only compression for outgoing packets. Backport upstream commit 1d5340fc.",
"evidence": "osv:CLSA-2026-1792513900",
"products": [
{
"name": {
"value": "openssh",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "openssh-askpass",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "openssh-clients",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "openssh-keycat",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "openssh-server",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "openssh-sk-dummy",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.7p1-30.el9_2.tuxcare.els25",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pam_ssh_agent_auth",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.4-5.30.el9_2.tuxcare.els25",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1792513900",
"aliases": [
"CLSA-2026-1792513900"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh",
"purl": "pkg:rpm/tuxcare/openssh?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh-askpass",
"purl": "pkg:rpm/tuxcare/openssh-askpass?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh-clients",
"purl": "pkg:rpm/tuxcare/openssh-clients?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh-keycat",
"purl": "pkg:rpm/tuxcare/openssh-keycat?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh-server",
"purl": "pkg:rpm/tuxcare/openssh-server?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.7p1-30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "openssh-sk-dummy",
"purl": "pkg:rpm/tuxcare/openssh-sk-dummy?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.4-5.30.el9_2.tuxcare.els25"
}
]
}
],
"package": {
"name": "pam_ssh_agent_auth",
"purl": "pkg:rpm/tuxcare/pam_ssh_agent_auth?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json"
}
}
],
"modified": "2026-10-26T09:43:51.844865980Z",
"provider": "osv",
"upstream": [
"CVE-2026-106552",
"CVE-2026-106582",
"CVE-2026-106584",
"CVE-2026-106586",
"CVE-2026-106587"
],
"references": [
"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792513900.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-106587"
]
},
"related_cves": [
{
"value": "CVE-2026-106552",
"evidence": "/upstream"
},
{
"value": "CVE-2026-106582",
"evidence": "/upstream"
},
{
"value": "CVE-2026-106584",
"evidence": "/upstream"
},
{
"value": "CVE-2026-106586",
"evidence": "/upstream"
},
{
"value": "CVE-2026-106587",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 450200,
"published_at": "2026-10-20T16:31:49+00:00"
}